Disagree. If a developer signs a build, then I can verify the build came from the developer. If it is signed by Google, then who knows what may have been inserted into the app. This is especially bad for open source and security conscious apps.
They really really don't need to touch your APK to get any user or app data. If you don't realize that, you may have been thinking of wrong threat models.
Or perhaps it makes more sense to not consider the developer of your operating system to be adversarial.
Yes, I've stripped, patched and re-signed apps and verified that installing them as an update failed.
For various reasons I think it's reasonable to assume it's more difficult to be running a phone with a compromised OS (particularly given the bootloader is unlockable and you can install a 100% OSS ROM) than to assume the Play store is not serving something malicious.
Besides, the worry is not "Google Evil". The worry is "Google might be coerced into compromising a specific user". For that usecase, presuming google is _not_ evil and has not backdoored pre-existing android installs, signed updates to apps actually help a lot.
As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. This is not about "protecting ourselves from Google". This is about making it as hard as possible for google to do bad things, so it is harder for outsiders to influence Google.
I think that, for the argument you are making, the play-store is the strongest point. I am unsure of how deep the privileges of the play-store run, but it has more control than most apps, and is easily google controlled. I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages.
But that is the whole point. People are apparently concerned about a backdoor using one channel and not in another, which makes little sense. Either you trust Google or you don't. "It would be a little trickier to ship a bad OS version / WebView implementation / GMS implementation" isn't an especially meaningful approach.
> As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app.
I don't believe there is any evidence for this.
> I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages.
If you are specifically worried about Signal then this change does not affect you because this is only a requirement for new apps. This is one reason why I find the argument that this is all a backdoor for the NSA so ridiculous. People seem to be claiming that the NSA has the strength to strongarm Google to implement a feature like this and roll it out for years (App Bundles have been around for a long time as an option) and is willing to wait for basically the entire market to turnover so that privacy-critical apps are all using this feature but can't force a change at the OS level that works universally.
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
If it's bound by the OS permission system and doesn't have full root, it might be able to replace apps with another version that is signed by a different key (using the "programmatic app installing" permission). However, that would wipe the app data and break app updates. Not even adb can replace an app with one that is signed by a different key without data loss (adb install -r). And I'm sure a lot of developers ask for this feature.
(I haven't actually tried whether you can really successfully switch signatures on an APK that way without losing all user data, tough)
Additionally, starting from Android 10 it seems that there is a new official feature allowing data to be kept after uninstallation if an app opts-in (https://stackoverflow.com/questions/58750567/how-to-enable-o...).
I think you have far too much confidence in this. How exactly would the average Android developer check to see if the SDK they downloaded from Android Studio doesn't have a targeted exploit in it? Or Android Studio itself for that matter?