Where are you grabbing the apk files though? taking them from third-party websites could be the worst idea ever. If you're taking them from Google play, you'll get the latest version and that probably won't be much help for you.
I remembered this website when you mentioned this, I had this same issue once except it was with a different type of apk, I found this website :
https://apkpure.com/coinomi-wallet-bitcoin-ethereum-altcoins-tokens/com.coinomi.wallet/versionsThey share hashes of the signature and file shasum.
So to OP, if you're paranoid (you should be) :
1. Download the apk
2. If you're on a windows install Java Development Kit.
(On linux just type jarsigner, and you'll see the packages you need to download)
3. In the console run "jarsigner -verify -verbose -certs your_application.apk"
4. Verify if the apk file is genuine.
A signed APK will show you information about the package owner, and all information about the android package that should match the same information on the latest version of the apk.