It's also fairly trivial to decompile an APK to verify they haven't done something as obvious as adding or replacing classes. In the Play Store case, they are d

It's also fairly trivial to decompile an APK to verify they haven't done something as obvious as adding or replacing classes. In the Play Store case, they are doing some extra asset minification and are serving split APKs with only the assets needed for the target device, which is certainly welcome as an end user with limited storage. I would, however, enjoy a scheme where I could trace the Play Store's signature back to the key I used to sign the app bundle for upload. Like if I could sign their key with mine.