So, it seems, that there is some "special, less strict" way to install packages for "trusted vendors", because it is much less probable to find a major flaw in

So, it seems, that there is some "special, less strict" way to install packages for "trusted vendors", because it is much less probable to find a major flaw in a standard jarsigner + zipalign procedure. If so, it is just another idiotic "management decision".