What's the point of Google asking for other people's private keys? That's not how asymetric encryption scheme are supposed to be used! Google could sign package

What's the point of Google asking for other people's private keys? That's not how asymetric encryption scheme are supposed to be used! Google could sign packages with their own keys, I don't see what they gain from having videolans' keys, except to impersonate them (which is fishy).