Hacker News Reader

The device itself still works with code signatures verified over time that derive from the same certificate, so giving Google your signing keys now lets Google forge updates of your app, but still prevents say, me, from doing so.

^ this.

I’m not familiar with Android signature approach. But it seems a pointless change to me. Just distribute additional CAs and re-sign my application.

This is like asking users to provide their cleartext passwords.

Android's PackageManager system doesn't use CAs. It's a trust-on-first-install system where any updates must be signed with the same cert as the original install. I don't know if it's still the case, but when I last looked at the code (around AOSP 6, I think), it did a byte-by-byte comparison of the certificate. If a update to an app was signed by even a renewed cert (with the same private key), Android would not allow it to be installed.

Then change how PackageManager works.

You have to sign it first, so the keys are still useful.