Google is not a unitary entity. The way Google uses those keys forces them to be on, or at least usable from, many machines accessible to many people. That is

Google is not a unitary entity. The way Google uses those keys forces them to be on, or at least usable from, many machines accessible to many people. That is bad key hygiene, and exposes the keys to many threats of many kinds. The people who maintain Android are not the people who curate the Play Store, nor are they necessarily using exactly the same tools or infrastructure. Letting the Play Store subvert security unilaterally enlarges the human, organizational, and technical attack surface for any number of threat actors. Furthermore it's easier to unobtrusively modify one user's copy of VLC than to modify one user's copy of Android, and also easier to change it back to cover your tracks. All of this significantly increases the chance of the whole system being subverted by any of a variety of threat actors from random rogue employees right on up to nation states. > Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices That could have been done without giving (any part of) Google the keys, using an obscure technique known as "a system design and manifest format that aren't minimum-effort-by-minimum-talent garbage". This is all really, really basic stuff. You don't just go around giving away giant attack surfaces for free. And Google is getting it wrong because doing it right would be slightly inconvenient.