> The mobile ecosystem has moved on a lot since monolithic APKs and user expectations are too high for them to be sufficient. As a user, I expect that software

> The mobile ecosystem has moved on a lot since monolithic APKs and user expectations are too high for them to be sufficient. As a user, I expect that software I run is protected from tampering. ... and there's no reason, other than laziness and "we know better than you do", that you can't define a manifest/asset signing format that supports that and supports incremental distribution of apps and doesn't demand giving the authentication keys for every single app to the distribution point.