I think Google has proven with their recent actions concerning android that they really can't be trusted with big, critical open source projects.
You talk as if the community has appointed Google to take care of these projects. Google is spending $$$ writing code and open sourcing it. Not the other way around.
And as with anything open source, if you dont like the direction of open source code - fork it.
If I have an open source project, you dont say 'bitpush cant be trusted with the project'.
The application signing backtrack is an issue, but more of a political problem than a technical one. America's lesson here has been written on the wall for years: regulate your tech businesses, or your tech businesses will regulate you.
Where are the security patches of the past couple of months?