Sounds like the mitigation might be just blacklisting the publically seen malware sideloadable APKs, that's a pretty weak mitigation if the keys have leaked.