There appears to be some sort of provision for this in newer versions, as apps can actually be aware of where they came from (necessary to simplify selecting bi

There appears to be some sort of provision for this in newer versions, as apps can actually be aware of where they came from (necessary to simplify selecting billing providers if you distribute via both Amazon and the Play Store). But yes, extending that to something deeper is probably needed, but you almost end up needing to alter the signing model of apks slightly. In the case of Amazon distributed builds I believe Amazon re-sign the apk completely, which is a bit of a workaround, whereas Google distribute the apks with the developer signatures. Really what you want is a chain of trust to sources of apps that the user trusts.