Android's PackageManager system doesn't use CAs. It's a trust-on-first-install system where any updates must be signed with the same cert as the original instal

Android's PackageManager system doesn't use CAs. It's a trust-on-first-install system where any updates must be signed with the same cert as the original install. I don't know if it's still the case, but when I last looked at the code (around AOSP 6, I think), it did a byte-by-byte comparison of the certificate. If a update to an app was signed by even a renewed cert (with the same private key), Android would not allow it to be installed.