Just a quick look, but this is the PackageManager.java file: https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/content/pm/Pa

Just a quick look, but this is the PackageManager.java file: https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/content/pm/PackageManager.java https://android.googlesource.com/platform/frameworks/base/+/... for the Android base framework. It has the checkSignatures() abstract definition and some other stuff that seems to be the API you talk about. Now this is all abstract, so some other party (maybe phone manufacturer, possibly others) must implement these methods to conform to the API. Could Google (or some other party) not just override the abstract implementation? I find it hard to believe this is something only the phone manufacturer would have access to, not Google itself, given that Google has created the entire operating system basically, and is pulling more and more stuff from the AOSP into their proprietary apps (like Play services).