You can freely update from a v2 signature to a v3 signature. If the minimum SDK version is below when v2 was introduced, Android will include both a v1 and v2

You can freely update from a v2 signature to a v3 signature. If the minimum SDK version is below when v2 was introduced, Android will include both a v1 and v2 signature by default. If the minimum SDK version is above when v2 was introduced but below when v3 was introduced, Android will only include a v2 signature by default. It will only include a v3 signature by default if the minimum SDK version is above when v3 was introduced, which is rare. The reason it works this way is because v2 was a significant security upgrade over v1 but v3 is just v2 with rotation support. If you do a key rotation, you get a v3 signature included to handle it for versions with key rotation support. If you support older versions, the users on those versions are still relying on the original keys. This is transparently supported in a way that it's backwards compatible. It would simply waste space to include v2 + v3 when no rotation has happened yet. I don't know why they bothered to micro-optimize to this extent but they did. For some reason the Play Store doesn't make use of Android's support for key rotations yet. They only support key rotations with Play Signing since they're phasing out non-Play-signed apps. If you switch from non-Play-signed to Play Signing, they keep signing the app for existing installs with the old key but switch to a new key for fresh installs. They do the same thing if you trigger a key rotation with the UI. They could rotate the key for existing users on Android versions with v3 support. They might as well rotate it even for users on versions predating it, since if they did get an OS upgrade it will start working right away.