Reputable APK sites publish SHA-256 hashes. Compare the hash of the file you downloaded with the one on the site.