It seems another design could have been used, that would likely have been more work but wouldn't rely on getting private signing keys. For instance, the OS cou

It seems another design could have been used, that would likely have been more work but wouldn't rely on getting private signing keys. For instance, the OS could have a carve out for these shims that allows a Google-signed app to overwrite an app, but without access to its local data. Then that overriding app could delete itself when the original is re-downloaded.