Field Notes

Android app signing helps connect a release to a signing identity and supports update relationships. It is important evidence, but a signature is not the same thing as a review of an application’s behavior or business practices.

Android discussions often use package as if it describes one thing. Separating the publishing artifact, the installable artifacts and the installed application makes many confusing download claims easier to assess.