I expect that they'll be providing some tools for people to generate the packages - and that tool can inject the top bar if it wants. It remains to be seen whether Google will provide search-results priority to "AMP" webpackages not generated with Google's tools (I think we'd all hate it if they didn't, but there's no obvious reason that they have to).

In particular, one obvious way to implement this would be to have everyone sign a static webpackage that includes a JS loader that pulls resources from www.google.com/amp/ via XHR/CORS (using ServiceWorkers I guess?), which would only need to be signed once, and send that over to Google. Then the infrastructure continues to work the way AMP does today - you just upload actual AMP-compatible web pages to your actual website, and Google downloads and caches them. Probably this webpackage would just include a single script tag that pulls the loader itself from Google, so that Google can apply updates to the loader without having to bother you again.

The webpackages spec talks more directly about signing the actual data, which would be way better for the web, but it's not obviously better for Google and for publishers already invested in AMP, so we should be cautious that maybe Google does not mean this and means something that's easier for them and retains the lock-in.