@julian It was a little thorny to setup, but it probably would be pretty simple! F-Droid is pretty friendly.
apt-get install fdroid server
fdroid init
fdroid update --create-keys
put apks in the repo folder
fdroid update -c
fdroid update
then point a webserver at the repo dir.
not saying that *anyone* can do that - but it's well within the ability to make an ansible playbook for!
But yeah - letting my 5yo install and remove apps gives him power without exposing him to the wider internet