yeah but the reality is that it doesn't say that for the app, it just says that for the signer… so if the app was originally from some obscure key, and some influencoor publishes another copy, it will tell the copy is the real one no? I guess we're not at that point and simple deductions like this works for 99.9% of the cases