> Public keys have another problem: people lose them. Google had to give up on letting developers manage their own keys eventually. The OS still understands tha

> Public keys have another problem: people lose them. Google had to give up on letting developers manage their own keys eventually. The OS still understands that, but most apps are distributed through the Play Store and when you do that Google re-signs your software with server side controlled keys. This ties apps to Google accounts instead of private keys, which is much safer for the developer (in availability terms). So, to correct the number of mistakes in that: - Apps distributed through Google Play are only resigned if the developer has uploaded their key to Google Play, or created the app within the last year - Google added the resigning not to improve availability, but instead to allow Google Play to modify the included libraries and dependencies in the app ad-hoc - For apps created within the last year, as the developer does not have access to their signing key, they cannot redistribute the app outside of the play store, which was the main goal from Google - The vast majority of apps installed today, even when installed through the play store, are still signed by the developer