3 ms·

Because somebody might’ve changed the files on the distribution servers. We’ve been signing executables for decades?

• segfaultbuserr 7y ago
  As a matter of fact, APKs are signed anyway using the pubkey of their developers, the signature is embedded in the package, regardless of whether it's in the app store of not. You cannot use a package with a different signature to replace the existing one, the system will warn you about a conflict. If someone has changed the files on the distribution servers. A Hacker News reader will have no problem recognizing it and stop installing, another one will compare the signature and keep it as evidence. Of course, the overwhelmingly majority cannot recognize it though.