I have some questions about how access to Secure Enclave, and in particular hardware keys, would work in a sideloaded app.

Could one sideloaded app somehow impersonate another sideloaded app, and thereby trick the PKA/SKP into signing a message with a private key that it shouldn't have access to?

If there is no way to securely distinguish between two sideloaded apps, such that one app could impersonate another in getting access to OS- or hardware-level cryptographic services, then that could be a real problem, I think.

I don't yet know enough about how these crypto services are implemented to know whether this would actually be a problem in practice, however.