How specific is the law? What if side loading requires a "trusted" signed certificate where trusted means from Google Play?

Not even playing devil's advocate, just wondering how many loopholes actually exist.