It pulls everything (apps, metadata, search results, etc.) directly from Google Play. It's entirely free and open source and recommended by almost everyone in the Android and privacy community, so yes, it's definitely legit.
Yeah. Some Android Custom ROMs ship Aurora instead of the Play Store. I try to get all of my apps from F-Droid, but when something isn't available there and I can't get it through Obtanium, I go with Aurora.