That's how android apks work. An app is signed with a public/private key combo, updates must match the same key. Surely something similar could be conceived. Keys could have an expiration date and someone would just need to post a signed update before it expires that implements an additional new key, then you could even upgrade extremely old versions through a couple of steps.