Other game stores have a more robust AV process due to the way they operate, so I think we should consider what free or low-cost options are available and suitable.
Can you please integrate the free VirusTotal or OPSWAT API ?
There are several Open Source browser extensions which could be forked and utilised.
The side effect would turn the launcher into a handy crowdsourced virus submission platform.
itch.io launcher has more insight into the installed games and folders, so could easily send the hashes of the game files
Users do not need a key for checking files, only to upload samples.
This is often an extra option in most tools, though there is no reason you could not use a key for itch (as long as you hide the key).
Following the standard and giving a users a way to add their key is more preferable in many ways but will limit the amount of uploads of new samples.
As developers here can use whatever download links they like on project pages, the one part of the end user experience that can be controlled by itch, is what happens when the user clicks the jscript powered DL button.
At that point if it is hosted by the CDN, then the hash can be sent for checking, and if it is anything else, eg. a web drive link or upload service, itch could show a warning that the file cannot be vouched for, and should be tested with AV first.
itch could send the URL to VirusTotal/OPSWAT where if the file was fetchable a report will be generated.
If integrated at an earlier stage such building the distros, users of the standard Butler distro system could be given simple but useful info to populate their project pages, such as file hashes, and if for android then a list of permissions.
Good and trustable authors will value showing such details, and malware authors may be discouraged from using itch.