Interesting (and disquieting). I can see this from Google's standpoint also... I don't expect them to shoulder the cost of interpreting a binary blob by decompi

Interesting (and disquieting). I can see this from Google's standpoint also... I don't expect them to shoulder the cost of interpreting a binary blob by decompiling it, so they're left with the problem that the trust calculus is that they're observing a user doing something with very sensitive user information in a binary blob they can't introspect. Hypothetically, one possible workaround (that definitely wouldn't work for all companies and requires more trust of Google than many will be comfortable with) would be to offer a feature where the package uploaded to Google for hosting on the Play Store includes source code and they compile it to native... But then you have the problem that a company will have to exfiltrate source code to a third party (even though the third party is the one with total control over their app's existence in the largest Android store).