This is no longer true as of 2021. You as a Google Play user with very limited exception (see next paragraph) have no assurance whether you've received the mobi

This is no longer true as of 2021. You as a Google Play user with very limited exception (see next paragraph) have no assurance whether you've received the mobile application bundle (.aad) the developer intended you to have, nor are you receiving the same application bundle everyone else in the world receives. Signatures controlled by Google are now used to sign the application bundle sent to each device[2]. It's not quite as bad (yet) as the Apple situation, but not far off. For a security conscious developer such as Signal who publish an APK (.apk) and signatures publicly[2], a user with a rooted device could theoretically unpack the official application bundle received from the Google Play Store and check the executable code and resources match those in the publicly available APK. Or just not use the Google Play Store and obtain your applications directly from the developer or an intermediary you place more trust in. [1] https://developer.android.com/studio/publish/app-signing https://developer.android.com/studio/publish/app-signing [2] https://signal.org/android/apk/ https://signal.org/android/apk/