That would be my assumption as well, but there are third-party application stores, like Amazon or the custom application repositories of carriers/manufacturers.

That would be my assumption as well, but there are third-party application stores, like Amazon or the custom application repositories of carriers/manufacturers. Presumably it is easy for any individual app store to filter for apps with duplicate cryptographic signatures but different content. But if someone could find an app and a spoofable signer that is present on one store but not another, they could submit an altered app under a spoofed name on the store that lacks the app. Spoofing privileged signers would hopefully be difficult on the Play store, but might be possible elsewhere.