I have been following the development from the beginning and the TL;DR is that the original maintainer deleted his repository, and a new maintainer appeared out of thin air, with the original maintainer’s signing keys. As of now, I would refrain from updating (the last presumed safe version to be found in the post linked below). In the future, there is a new fork from a trusted packager of the GPlay version of Syncthing-fork which might be the way forward, or one might use another client altogether.

More story: The new maintainer says they got the keys from the original maintainer after agreeing to maintain the application instead of the original maintainer so that the original maintainer can retire. However, the alleged “transition” was done so poorly (more like sketchy as all …) that the community has mostly decided to, at least for now, not blindly trust the new maintainer as there is no indication from the original maintainer that such a transition was indeed done, and that nothing malicious is going on. Nothing malicious has been found for now, but everything is sketchy as … Time might help mend the broken trust, but I would say that at this point and with the behaviour of the new maintainer so far, that is somewhat unlikely.

Read more on this in the official Syncthing forum post.

For anyone who’s confused: syncthing-fork is the Android client. Not the main repository.