Android and the Google Play store works pretty well. The systems "locks on to" a public key signature so further updates for a given app must be signed with the

Android and the Google Play store works pretty well. The systems "locks on to" a public key signature so further updates for a given app must be signed with the same key. That would fix the problem with reproducible builds here. Only adding new top level packages to a project for the first time is at risk then.