According to the Android Developer Documentation:
Android requires that all apps be digitally signed with a certificate. [...]
The certificate does not need to be signed by a certificate authority.
At least in my case - multiple apps with small user base - they are all self-signed.
For self-signed Apps a third party could tamper with the APK and self-sign it again. This would be quite hard to detect for the end-user. Stock-Android does not check if the Code-Signing-Certificate is trusted.
It just validates that - for example in case of an update - it's the same developer the two APKs come from:
If you publish an app to Google Play and then lose the key with which you signed your app, you will not be able to publish any updates to your app, since you must always sign all versions of your app with the same key.
As @Noir already stated in his comment: You already trust Google - you are using Android - so they already have all possibilities.