Question

With regards to the certificate used for code signing for Android Marketplace,
I realize that using a trusted third party to sign such a certificate is … unlikely, for reasons that have been discussed.
However an organization could create their own certificate authority, and sign the certificate that way.

My question is, would there be any advantage whatsoever to doing it this way?
I get the impression that really the only thing that matters is the private key used to sign the code (and perhaps the expiration date) and that any other certificate information, such as chain of authority or CRL location is not utilized by the system in any way.

Thanks.

Answer 1

Not that I can see. Since it’s a public-private key pair, the only thing that matters is that you hold the private key. Signing with Google vs. a trusted third party doesn’t matter.