The application code isn't responsible for checking the signatures. That wouldn't make any sense because a malicious app would simply not check its signature.