Google does implement the apk signing verification (shipped as a binary in their ROMs), and they could easily make exceptions for applications if they wanted to

Google does implement the apk signing verification (shipped as a binary in their ROMs), and they could easily make exceptions for applications if they wanted to. Don't assume that what you see in AOSP is the source form of what google ships.