> As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. This i

> As far as I know, once a backdoored app is signed with the correct key, there's nothing stopping the partner CDN(s) from serving it to targeted users. This is true for native software distributed by various linux distro maintainers too.