On Android, I recall that updates to a package must be signed by the same key as the package being updated, otherwise the device itself will reject the update.

On Android, I recall that updates to a package must be signed by the same key as the package being updated, otherwise the device itself will reject the update. Doesn't that mean that only the Signal developers (who are the ones who signed the original package) would be able to create a compromised update?