> That's not how Android app signing works. It's a "trust on first use" model, so once you install an app, any update must be signed by the same key or the syst

> That's not how Android app signing works. It's a "trust on first use" model, so once you install an app, any update must be signed by the same key or the system will refuse to install it. That key is held by Signal, not Google, so Google cannot sign updates to apps. My understanding (and I'd love to be corrected if I'm wrong) is that Google Play Services run with access to root privileges, and thus can circumvent this protection without the user becoming aware.