Question

I have a piece of code in my application that retrieves the application certificate at runtime and uses it as a key to encrypt some confidential information.

Is it possible for some attacker to get that certificate byte[] by decompiling my code or is that certificate only visible to my application?

Here is how I get the certificate:

    PackageManager pm = this.getPackageManager();
    String packageName = this.getPackageName();
    int field = PackageManager.GET_SIGNATURES;
    PackageInfo packageInfo;

    packageInfo = pm.getPackageInfo(packageName, field);

    Signature[] signatures = packageInfo.signatures;

    // and here we have the DER encoded X.509 certificate
    byte[] certificate = signatures[0].toByteArray()

Answer 1

PackageInfo signature is public key,

It is not private key. And this key is accessible to any app installed on your phone.