As I have been reading about the Android Keychain API, I have been particularly concerned about whether or not Android provides a way to restrict the keys installed as part of Keychain API to certain trusted apps only. For instance, can YouTube ensure that its Keychain installed credentials are only accessible to and by the sister apps such as Chrome, YT Music, Playstore, GPay etc.
This stackexchange answer went a long way in neatly explaining the basics, however, there hasn't been much reading material available on whether or not a certain manufacturer can restrict the cryptographic keys stored in the Keychain API to apps developed and signed by its authorized developers only. Just to be clear, I am exploring a feature supported by Keychain API that is very much equivalent to the "signature" protectionLevel in android:protectionLevel
I'd appreciate any education in this area, thanks in advance.