Yes, that is fairly concerning. The last news I had about this was that using Google Play Signing (their key escrow and app signing service) was only mandatory

Yes, that is fairly concerning. The last news I had about this was that using Google Play Signing (their key escrow and app signing service) was only mandatory for new apps as of August 2021. Not sure if that has changed recently. But everyone can see it coming a mile away, that Google will only continue tightening that grip. To be honest, I understand the potentially good intentions behind Google's push to manage keys for app developers. It is not trivial to (1) keep private keys secure, and (2) not lose access to them over a long enough period of time. So Google can store them in HSMs in their datacenters and provide backups and access controls and such. But it also gives them the ability to deliver app updates with "extra stuff" for targeted individuals. See Figure 1 of [1]. That doesn't look very nice to me. [1] https://developer.android.com/studio/publish/app-signing https://developer.android.com/studio/publish/app-signing