de0u
You are right (both of you, also @Watermelon ), I dug better in the documentation, and indeed, Google has the private part of the signing key.
I am in shock, even if this thing is already 5 years old, I discovered it just now, and for straight two days I wouldn't believe of what I was reading, literally.
I apologize for spreading misinformation in this thread (if any) for what concerns apk signing, I cannot edit my previous posts, but hopefully people will read the whole thread and figure the bad part.
I guess we will accept (as if we had choice lol) that Google’s threat model assumes "Someone will notice" and don't do shady stuff, even if I always consider that a company could not only be malicious, but also compromised and most important, coerced to do things.
If we take into account that Google is responsable for the whole Play’s existing dynamic delivery infrastructure , I can see how a government agency could issue secret orders to modify an apk per geography, per account type or per Android version.
This is not mere science fisction, it’s exactly the threat model behind supply-chain attacks, hardware root-of-trust debates and zero-trust architectures.
I am not saying they are doing it, just that it's thecnically possible to do it.
Let's hope it stays just theoretical and never breaks into practice.