Made the rounds a week or two ago. Use graphene.

Application developers register with google and get a signing certificate.

Apps not signed with such a cert cannot be installed on Certified Android Devices.

Developer certificates can be revoked because Drumph or Biden or Graham or Cortez... you get it.

Certified Devices will come with a Digital ID app and you won't be able to uninstall it. Your device will no longer be optional, it will be provided as part of your UBI. No device no UBI.

I need a fucking sandwich sign.