Actually Google is adding a way to verify it came from them: https://android-developers.googleblog.com/2018/06/google-play-security-metadata-and.html https://a

Actually Google is adding a way to verify it came from them: https://android-developers.googleblog.com/2018/06/google-play-security-metadata-and.html https://android-developers.googleblog.com/2018/06/google-pla... They specifically cite being able to do this peer to peer.