Glossary
APK Signing (Android App Signatures)
Every Android APK is signed with a developer certificate; the signature decides who can update an app and helps separate genuine apps from lookalike malware.
Every Android app package (APK) must be signed with a private key before it can be installed. Android verifies the signature at install and on every update, and only accepts an update signed by the same certificate (or a rotated certificate the original key approved). The signature schemes have evolved: v1 (JAR signing, per-file), v2 (Android 7, whole-file), v3 (Android 9, adds key rotation) and v4 (Android 11, for incremental installs).
On devices, the signing certificate of every installed package is recorded in packages.xml, and apksigner verify --print-certs base.apk prints it from a copied APK. Apps distributed through Google Play increasingly use Play App Signing, where Google holds the app signing key.
For forensic triage the certificate is a stronger identity than the package name or label. Malware often copies the name and icon of a legitimate app ("Chrome Update", com.android.system.service) but cannot reproduce its signature, so comparing the certificate digest with the genuine publisher's, or with indicator lists, quickly separates impostors. Signatures also group apps from the same developer and reveal debug-signed test builds. See the malware and stalkerware triage guide.