Yes, AppTransaction.shared is the right StoreKit 2-way to prove the app is obtained from the App Store. A .verified result means the JWS was cryptographically validated for your app and the device.That’s why you keep seeing .verified on legitimate installs. It’s not a “who is currently signed into the App Store" check