From 17ba581f8876586779dd9a9d99f1e642699f73a5 Mon Sep 17 00:00:00 2001
From: austinried <4966622+austinried@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:06:03 +0000
Subject: [PATCH] docs: list F-Droid before nightly in the signing channels

---
 signing/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/signing/README.md b/signing/README.md
index 0f42098d..9a324848 100644
--- a/signing/README.md
+++ b/signing/README.md
@@ -4,8 +4,8 @@ subtracks ships through four channels:
 
 - **GitHub releases** — the APK and the AAB are signed with the release key. The public certificate is committed here as [`release-certificate.pem`](release-certificate.pem) and attached to each release, along with a `SHA256SUMS`.
 - **Google Play** — uses Play App Signing, so Google re-signs the app it delivers. The release key is only the *upload* key there: it signs the AAB we send to Play, not the APK users install. The installed app verifies against Google's app signing certificate (Play Console → App integrity), and the upload key only proves the AAB we uploaded.
-- **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with the public debug key committed here as [`nightly-certificate.pem`](nightly-certificate.pem).
 - **F-Droid** — re-signed by F-Droid with its own key; see F-Droid's published signing key.
+- **`nightly` builds** (the `subtracks-nightly` artifact from CI) — signed with the public debug key committed here as [`nightly-certificate.pem`](nightly-certificate.pem).
 
 ## GitHub releases