Application developers register with google and get a signing certificate.

Apps not signed with such a cert cannot be installed on Certified Android Devices.

Developer certificates can be revoked because Drumph or Biden or Graham or Cortez... you get it.