Can any Google Play Store tampering be detected?

Question

I've read this Android developers page regarding code signing that states:

You can use self-signed certificates to sign your applications. No certificate authority is needed.

I have also read the answers to "How could one detect if Apple/Google/etc. has modified a third party application distributed through their App Stores?"

My question is: If Google is forced to tamper with a particular Android app on the Play Store (e.g. TextSecure) to compromise it, is any defense possible against tampering targeted at particular individuals?

Example scenario: Persons of interest are using TextSecure on their Android phones to communicate. A government forces Google to push modified versions of TextSecure to those phones to compromise communications.

I can think of one roundabout solution: Using a fork of the Android OS that isn't updated by Google, install a non-Play Store app that constantly checks the validity of the existing TextSecure installation (perhaps using something as simple as hash values).

Are there any other possibilities? (e.g. If an app is signed with a CA-validated cert, would it be checked at run time?)

Answer 1

You would need to manually check that the signature is from the application developer. Google shouldn't have the private key that the official release is signed with. Google however could easily make their own signature as they are the signing authority for the Play store, however the new signature wouldn't match up with the certificate for the official application unless Google somehow has the private key the application author used for signing the official version.