> With Play App Signing, Google manages and protects your app's signing key for you and uses it to sign optimized, distribution APKs that are generated from your app bundles

There is no meaning of having a private signing key if is not private. Why does Google need me to upload a private key if they are then free to use it on their own?

https://support.google.com/googleplay/android-developer/answ...

Sure there is. You’re increasing the scope of the key to include a third party, but… it’s one that controls the OS, distribution channels, publishing platform, SDK, the tools used to publish APKs, even the device drivers on your phone.

If they want to maliciously modify the VLC apk, there isn’t anything you can do to stop them.

I think we all understand why Google might have a need to sign the binaries themselves. The point is that if they are creating binaries it should be signed by Google using a key uploaded by me it is just unnecessary.

For those who don't want to follow even more Twitter links: It looks like for Windows Store, they are unable to contact a human at Microsoft for technical help, and for Android Play, the store itself is insisting on obtaining their private signing keys and that they drop support for older API versions.

An important note about their Windows store issue: they've been trying to get help for two years now.

What specific technical things do they need help with? Being more clear than “we just need a human to talk to” is better.

Yeah, that one is suspect.

Having submitted a number of “product breaking bug reports” through official channels while using a paid support incident, can confirm Kafkaesque and a multi year support process.

Oh, I can get a person to “respond” to a problem with a paid support incident. But the person responding is clearly hired only based on their ability to respond to an English email, once a week, with either, “thank you, I will forward that to our engineering team” or “thank you for your patience, our engineers are still looking into that issue.”

Severity, impact, paid support, none of that matters. Heck, it’s impossible to tell if it’s an actual person or just a sophisticated shell script.