I've read this Android developers page regarding code signing that states:
You can use self-signed certificates to sign your applications. No certificate authority is needed.
I have also read the answers to "How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?"
My question is: If Google is forced to tamper with a particular Android app on the Play Store (e.g. TextSecure) to compromise it, is any defense possible against tampering targeted at particular individuals?
Example scenario: Persons of interest are using TextSecure on their Android phones to communicate. A government forces Google to push modified versions of TextSecure to those phones to compromise communications.
I can think of one roundabout solution: Using a fork of the Android OS that isn't updated by Google, install a non-Play Store app that constantly checks the validity of the existing TextSecure installation (perhaps using something as simple as hash values).
Are there any other possibilities? (e.g. If an app is signed with a CA-validated cert, would it be checked at run time?)