> How is this even possible that Google allows this? Is this really true? Yes, you only need to upload the key (meaning, include a `key.pem` in your packed zip

> How is this even possible that Google allows this? Is this really true? Yes, you only need to upload the key (meaning, include a `key.pem` in your packed zip file) on first upload. [0] However, I'm not sure if Google will allow you to upload with a _different_ key. Since that would cause the extension ID to change, I'm not sure what would happen, both to the webstore page (does the previous one 301 to the new one?) and to existing installations (do they stop auto-updating?). Incidentally, I expect this is also the reason Google allows subsequent uploads without the key. They don't want someone to lose their extension when they lose their private key. > This weekend Chrome decided to disable all these extensions on just one machine There is a trick for this, if you are loading an unpacked extension. Simply edit `manifest.json` in the unpacked extension directory, to add a `"key": "<base64 encoded public key>"`, where that public key matches the public key associated with the extension from the store. You can do this with any extension from the store, since you can extract the public key from a .crx file [1]. When you load an extension this way, the ID will be the same as the "real" extension. [0] https://groups.google.com/a/chromium.org/g/chromium-extensions/c/Su50pbNzRms/m/VbQhXEnkAwAJ https://groups.google.com/a/chromium.org/g/chromium-extensio... (note the "You don't need to repeat this procedure ever again") [1] https://github.com/milesrichardson/crxmon/blob/4dae445b05b7641bad491834df00669764be568e/scripts/lib/extension-crypto.ts https://github.com/milesrichardson/crxmon/blob/4dae445b05b76...