Starting in August, Google will require that they sign apps, not you
If I put an extra bit of tinfoil on my hat, I might speculate this is actually encouraged by the CIA/NSA/FBI or similar parties.Certainly, they now have the option of trying to force google into delivering modified apps to certain people. This situation changes the trust model for e.g. signal from "do you trust the app developer" to "do you trust google" against the pressures of hacking and legal requirement of cooperation. The fact that reproducible builds become _that much_ more difficult with this is extra bad. It takes away a rather effective "after the fact" detection mechanism for these kinds of abuses.It seems obvious to me there are plenty of important app developers (like signal) that are less likely to bow before the long arm of the US than the google play store. Also because for a principled developer, their app is likely 100% of their business. Whereas for google, any app is only a small part of their business. Google simply has much less incentive to defend the users of a single app that the developer.Hence, it seems to me that this situation is realistically going to lead to more ways for law enforcement to access secret data on your devices. Whether this is part of the motivation for this change or not, the effect seems unavoidable.