The OP says they're planning to use the Web Packaging standard. That standard prevents third parties (like Google) from injecting content into the packages by requiring the page to be signed by the original site's private key.

That's how they're able to display the original page's URL in the browser without that practice being extremely misleading.

I expect that they'll be providing some tools for people to generate the packages - and that tool can inject the top bar if it wants. It remains to be seen whether Google will provide search-results priority to "AMP" webpackages not generated with Google's tools (I think we'd all hate it if they didn't, but there's no obvious reason that they have to).

In particular, one obvious way to implement this would be to have everyone sign a static webpackage that includes a JS loader that pulls resources from www.google.com/amp/ via XHR/CORS (using ServiceWorkers I guess?), which would only need to be signed once, and send that over to Google. Then the infrastructure continues to work the way AMP does today - you just upload actual AMP-compatible web pages to your actual website, and Google downloads and caches them. Probably this webpackage would just include a single script tag that pulls the loader itself from Google, so that Google can apply updates to the loader without having to bother you again.

The webpackages spec talks more directly about signing the actual data, which would be way better for the web, but it's not obviously better for Google and for publishers already invested in AMP, so we should be cautious that maybe Google does not mean this and means something that's easier for them and retains the lock-in.

Doesn't amp require including amp specific JavaScript? That would jump right past any need for it.

If the bar is going away Google can help themselves by saying that specifically. I'm not the only one that hates that thing.