{
  "schemaVersion": 1,
  "id": "android-signing-key-changes-2026-11-11",
  "status": "evidence-reviewed",
  "url": "https://apporiginlab.com/research/android-signing-key-changes/",
  "dataUrl": "https://apporiginlab.com/data/android-signing-key-changes-2026-11-11.json",
  "title": "Android signing-key changes: three measured release histories",
  "description": "Nine developer-published GitHub release APKs show three first-party-announced key replacements, one earlier unexplained signer change, and no verified proof-of-rotation lineage.",
  "question": "Can developer-announced Android signing-key changes be bound to adjacent measured APK signer sets without treating a release note as cryptographic proof of rotation?",
  "evidenceDate": "2026-11-11",
  "updatedDate": "2026-11-11",
  "methodologyVersion": "0.1",
  "selection": "Purposive edge-case sample selected for documented key changes; not a random or prevalence sample.",
  "toolchain": {
    "androidBuildTools": "37.0.0",
    "apksigJar": "Android SDK Build Tools apksigner.jar",
    "java": "openjdk version \"17.0.20\" 2026-07-21",
    "elfParser": "apporiginlab-pilot-elf64-v1"
  },
  "counts": {
    "artifacts": 9,
    "projects": 3,
    "transitions": 6,
    "announcedKeyReplacements": 3,
    "unexplainedChanges": 1,
    "verifiedLineageSegments": 0,
    "installationTests": 0
  },
  "artifacts": [
    {
      "id": "poker-1.1.12",
      "project": "Poker Payout",
      "packageName": "com.huntercoles.pokerpayout",
      "versionName": "1.1.12",
      "versionCode": "24",
      "size": 13654270,
      "sha256": "9a4f03129c0af89883ece1005949f6515445c0b803240474ac77670d17a5f4a4",
      "sourcePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.1.12",
      "channel": "developer-github",
      "signatureSchemes": [
        "v2"
      ],
      "signers": [
        {
          "sha256": "0558e11420a97f212d7048f6b04351fdc82498f9d69cc5c0115270b5e2853de7",
          "certificateKind": "named-certificate",
          "notBefore": "2025-11-21T23:42:48Z",
          "notAfter": "2053-04-08T23:42:48Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "poker-1.2.0",
      "project": "Poker Payout",
      "packageName": "com.huntercoles.pokerpayout",
      "versionName": "1.2.0",
      "versionCode": "25",
      "size": 13670654,
      "sha256": "8d326f70766465801ee6b843853deae3128cb53feddf91805c57f48ca1eb2433",
      "sourcePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.2.0",
      "channel": "developer-github",
      "signatureSchemes": [
        "v2"
      ],
      "signers": [
        {
          "sha256": "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0",
          "certificateKind": "named-certificate",
          "notBefore": "2026-10-05T00:57:14Z",
          "notAfter": "2054-02-20T00:57:14Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "poker-1.4.28",
      "project": "Poker Payout",
      "packageName": "com.huntercoles.pokerpayout",
      "versionName": "1.4.28",
      "versionCode": "69",
      "size": 2562513,
      "sha256": "ec3218870ec32dcf24e05e7f30a40e02cb4fc46275d6081866568609f4e38c3e",
      "sourcePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.4.28",
      "channel": "developer-github",
      "signatureSchemes": [
        "v2"
      ],
      "signers": [
        {
          "sha256": "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0",
          "certificateKind": "named-certificate",
          "notBefore": "2026-10-05T00:57:14Z",
          "notAfter": "2054-02-20T00:57:14Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "obs-2.1.0",
      "project": "OBS Blade",
      "packageName": "com.kounex.obsBlade",
      "versionName": "2.1.0",
      "versionCode": "2022053101",
      "size": 26428076,
      "sha256": "1fd9380e2d5a777bd252b1f7c6db393c9d5e5d70ec5d0eda4a0975a4401cfd92",
      "sourcePage": "https://github.com/Kounex/obs_blade/releases/tag/2.1.0",
      "channel": "developer-github",
      "signatureSchemes": [
        "v1",
        "v2"
      ],
      "signers": [
        {
          "sha256": "1ae300a84a6581ddcd430c125860b2444625291d37565ae43b25469ede1a8662",
          "certificateKind": "named-certificate",
          "notBefore": "2020-07-11T17:44:33Z",
          "notAfter": "2047-11-27T17:44:33Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "obs-3.2.0",
      "project": "OBS Blade",
      "packageName": "com.kounex.obsBlade",
      "versionName": "3.2.0",
      "versionCode": "2023012003",
      "size": 26795730,
      "sha256": "5c9397cf32cf9766797e033426384e72fe9289c865c11ff14d50413edbbbb116",
      "sourcePage": "https://github.com/Kounex/obs_blade/releases/tag/foss-3.2.0",
      "channel": "developer-github",
      "signatureSchemes": [
        "v1",
        "v2"
      ],
      "signers": [
        {
          "sha256": "9183c56b5518a3215d18c0fe9e244d64a1a94917dd4df86019c46ad7a7f03ac1",
          "certificateKind": "android-debug",
          "notBefore": "2023-05-02T11:32:48Z",
          "notAfter": "2053-04-24T11:32:48Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "obs-4.2.0",
      "project": "OBS Blade",
      "packageName": "com.kounex.obsBlade",
      "versionName": "4.2.0",
      "versionCode": "2026102003",
      "size": 76152057,
      "sha256": "13ee8eb4feb5185d27be01b09696c30c7d0da8e6badb3c730cf6b5cae6c62d17",
      "sourcePage": "https://github.com/Kounex/obs_blade/releases/tag/foss-4.2.0",
      "channel": "developer-github",
      "signatureSchemes": [
        "v2"
      ],
      "signers": [
        {
          "sha256": "dacd5fe5e0e07a61ead879829101c36d664e56c5af269f6e9789e102c64a4c19",
          "certificateKind": "named-certificate",
          "notBefore": "2026-10-22T09:00:50Z",
          "notAfter": "2076-10-09T09:00:50Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "messages-1.0.7",
      "project": "Messages",
      "packageName": "org.prauga.messages",
      "versionName": "1.0.7",
      "versionCode": "8",
      "size": 51451978,
      "sha256": "cdc4224da333f4b768dc28b4745856958fbd99633e44297c08673230cec5f87b",
      "sourcePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.7",
      "channel": "developer-github",
      "signatureSchemes": [
        "v1",
        "v2"
      ],
      "signers": [
        {
          "sha256": "4db7e290e29ae42aa02282b97d4e86edab6700464f7daa4ac8f9a0ceef4efbfd",
          "certificateKind": "named-certificate",
          "notBefore": "2025-11-30T12:46:18Z",
          "notAfter": "2050-11-24T12:46:18Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "messages-1.0.8",
      "project": "Messages",
      "packageName": "org.prauga.messages",
      "versionName": "1.0.8",
      "versionCode": "9",
      "size": 51468596,
      "sha256": "9f63cffe482744703a8cc0d176cdcbbcade710d1cb13122a922d39787b5d0dd9",
      "sourcePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.8",
      "channel": "developer-github",
      "signatureSchemes": [
        "v1",
        "v2"
      ],
      "signers": [
        {
          "sha256": "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da",
          "certificateKind": "named-certificate",
          "notBefore": "2026-10-15T12:42:10Z",
          "notAfter": "2051-10-09T12:42:10Z"
        }
      ],
      "verifiedLineageSegments": 0
    },
    {
      "id": "messages-1.0.10",
      "project": "Messages",
      "packageName": "org.prauga.messages",
      "versionName": "1.0.10",
      "versionCode": "12",
      "size": 51335223,
      "sha256": "73c6a968e8b59260019b799b229e604aafa9a47ad6c0bfaf2c3aace878ccf6fc",
      "sourcePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.10",
      "channel": "developer-github",
      "signatureSchemes": [
        "v2"
      ],
      "signers": [
        {
          "sha256": "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da",
          "certificateKind": "named-certificate",
          "notBefore": "2026-10-15T12:42:10Z",
          "notAfter": "2051-10-09T12:42:10Z"
        }
      ],
      "verifiedLineageSegments": 0
    }
  ],
  "projects": [
    {
      "project": "Poker Payout",
      "classification": "first-party-announced-key-replacement",
      "installationConsequence": "not-tested",
      "artifacts": [
        {
          "id": "poker-1.1.12",
          "project": "Poker Payout",
          "packageName": "com.huntercoles.pokerpayout",
          "versionName": "1.1.12",
          "versionCode": "24",
          "size": 13654270,
          "sha256": "9a4f03129c0af89883ece1005949f6515445c0b803240474ac77670d17a5f4a4",
          "sourcePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.1.12",
          "channel": "developer-github",
          "signatureSchemes": [
            "v2"
          ],
          "signers": [
            {
              "sha256": "0558e11420a97f212d7048f6b04351fdc82498f9d69cc5c0115270b5e2853de7",
              "certificateKind": "named-certificate",
              "notBefore": "2025-11-21T23:42:48Z",
              "notAfter": "2053-04-08T23:42:48Z"
            }
          ],
          "verifiedLineageSegments": 0
        },
        {
          "id": "poker-1.2.0",
          "project": "Poker Payout",
          "packageName": "com.huntercoles.pokerpayout",
          "versionName": "1.2.0",
          "versionCode": "25",
          "size": 13670654,
          "sha256": "8d326f70766465801ee6b843853deae3128cb53feddf91805c57f48ca1eb2433",
          "sourcePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.2.0",
          "channel": "developer-github",
          "signatureSchemes": [
            "v2"
          ],
          "signers": [
            {
              "sha256": "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0",
              "certificateKind": "named-certificate",
              "notBefore": "2026-10-05T00:57:14Z",
              "notAfter": "2054-02-20T00:57:14Z"
            }
          ],
          "verifiedLineageSegments": 0
        },
        {
          "id": "poker-1.4.28",
          "project": "Poker Payout",
          "packageName": "com.huntercoles.pokerpayout",
          "versionName": "1.4.28",
          "versionCode": "69",
          "size": 2562513,
          "sha256": "ec3218870ec32dcf24e05e7f30a40e02cb4fc46275d6081866568609f4e38c3e",
          "sourcePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.4.28",
          "channel": "developer-github",
          "signatureSchemes": [
            "v2"
          ],
          "signers": [
            {
              "sha256": "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0",
              "certificateKind": "named-certificate",
              "notBefore": "2026-10-05T00:57:14Z",
              "notAfter": "2054-02-20T00:57:14Z"
            }
          ],
          "verifiedLineageSegments": 0
        }
      ],
      "transitions": [
        {
          "fromId": "poker-1.1.12",
          "toId": "poker-1.2.0",
          "fromVersion": "1.1.12",
          "toVersion": "1.2.0",
          "previousSigners": [
            "0558e11420a97f212d7048f6b04351fdc82498f9d69cc5c0115270b5e2853de7"
          ],
          "currentSigners": [
            "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0"
          ],
          "classification": "first-party-announced-key-replacement",
          "notice": {
            "sourceUrl": "https://api.github.com/repos/HunterColes/PokerPayout/releases/tags/v1.2.0",
            "releasePage": "https://github.com/HunterColes/PokerPayout/releases/tag/v1.2.0",
            "accessedDate": "2026-11-11",
            "snapshotSha256": "4783b73aaaedbb79509d99b11ee5bd01fc9b036c2eb891291accc7ec89f33f83",
            "explanation": "The developer's v1.2.0 release notes say the old signing key was lost, this build uses a new key, and updating from an older build requires a one-time reinstall."
          }
        },
        {
          "fromId": "poker-1.2.0",
          "toId": "poker-1.4.28",
          "fromVersion": "1.2.0",
          "toVersion": "1.4.28",
          "previousSigners": [
            "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0"
          ],
          "currentSigners": [
            "223c397a82d6ed7b50659d30ed907ed23b200509b84fdcf8412f4ed859db35c0"
          ],
          "classification": "same-key",
          "notice": null
        }
      ]
    },
    {
      "project": "Messages",
      "classification": "first-party-announced-key-replacement",
      "installationConsequence": "not-tested",
      "artifacts": [
        {
          "id": "messages-1.0.7",
          "project": "Messages",
          "packageName": "org.prauga.messages",
          "versionName": "1.0.7",
          "versionCode": "8",
          "size": 51451978,
          "sha256": "cdc4224da333f4b768dc28b4745856958fbd99633e44297c08673230cec5f87b",
          "sourcePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.7",
          "channel": "developer-github",
          "signatureSchemes": [
            "v1",
            "v2"
          ],
          "signers": [
            {
              "sha256": "4db7e290e29ae42aa02282b97d4e86edab6700464f7daa4ac8f9a0ceef4efbfd",
              "certificateKind": "named-certificate",
              "notBefore": "2025-11-30T12:46:18Z",
              "notAfter": "2050-11-24T12:46:18Z"
            }
          ],
          "verifiedLineageSegments": 0
        },
        {
          "id": "messages-1.0.8",
          "project": "Messages",
          "packageName": "org.prauga.messages",
          "versionName": "1.0.8",
          "versionCode": "9",
          "size": 51468596,
          "sha256": "9f63cffe482744703a8cc0d176cdcbbcade710d1cb13122a922d39787b5d0dd9",
          "sourcePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.8",
          "channel": "developer-github",
          "signatureSchemes": [
            "v1",
            "v2"
          ],
          "signers": [
            {
              "sha256": "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da",
              "certificateKind": "named-certificate",
              "notBefore": "2026-10-15T12:42:10Z",
              "notAfter": "2051-10-09T12:42:10Z"
            }
          ],
          "verifiedLineageSegments": 0
        },
        {
          "id": "messages-1.0.10",
          "project": "Messages",
          "packageName": "org.prauga.messages",
          "versionName": "1.0.10",
          "versionCode": "12",
          "size": 51335223,
          "sha256": "73c6a968e8b59260019b799b229e604aafa9a47ad6c0bfaf2c3aace878ccf6fc",
          "sourcePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.10",
          "channel": "developer-github",
          "signatureSchemes": [
            "v2"
          ],
          "signers": [
            {
              "sha256": "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da",
              "certificateKind": "named-certificate",
              "notBefore": "2026-10-15T12:42:10Z",
              "notAfter": "2051-10-09T12:42:10Z"
            }
          ],
          "verifiedLineageSegments": 0
        }
      ],
      "transitions": [
        {
          "fromId": "messages-1.0.7",
          "toId": "messages-1.0.8",
          "fromVersion": "1.0.7",
          "toVersion": "1.0.8",
          "previousSigners": [
            "4db7e290e29ae42aa02282b97d4e86edab6700464f7daa4ac8f9a0ceef4efbfd"
          ],
          "currentSigners": [
            "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da"
          ],
          "classification": "first-party-announced-key-replacement",
          "notice": {
            "sourceUrl": "https://api.github.com/repos/PVOT-OSS/Messages/releases/tags/v1.0.8",
            "releasePage": "https://github.com/PVOT-OSS/Messages/releases/tag/v1.0.8",
            "accessedDate": "2026-11-11",
            "snapshotSha256": "9b8cb2b9bf97c058619228bdbf50b3d66b293f6c96bd9679789fbbb01120d4c1",
            "explanation": "The developer's v1.0.8 release notes say the previous signing key was lost in a system reset, the keys changed, and users may need to uninstall and reinstall."
          }
        },
        {
          "fromId": "messages-1.0.8",
          "toId": "messages-1.0.10",
          "fromVersion": "1.0.8",
          "toVersion": "1.0.10",
          "previousSigners": [
            "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da"
          ],
          "currentSigners": [
            "b8bfa22abacbff2e62a4b3b39f49c704c93e0fb07032e8f30bf3c7badca2d9da"
          ],
          "classification": "same-key",
          "notice": null
        }
      ]
    },
    {
      "project": "OBS Blade",
      "classification": "unexplained-change",
      "installationConsequence": "not-tested",
      "artifacts": [
        {
          "id": "obs-2.1.0",
          "project": "OBS Blade",
          "packageName": "com.kounex.obsBlade",
          "versionName": "2.1.0",
          "versionCode": "2022053101",
          "size": 26428076,
          "sha256": "1fd9380e2d5a777bd252b1f7c6db393c9d5e5d70ec5d0eda4a0975a4401cfd92",
          "sourcePage": "https://github.com/Kounex/obs_blade/releases/tag/2.1.0",
          "channel": "developer-github",
          "signatureSchemes": [
            "v1",
            "v2"
          ],
          "signers": [
            {
              "sha256": "1ae300a84a6581ddcd430c125860b2444625291d37565ae43b25469ede1a8662",
              "certificateKind": "named-certificate",
              "notBefore": "2020-07-11T17:44:33Z",
              "notAfter": "2047-11-27T17:44:33Z"
            }
          ],
          "verifiedLineageSegments": 0
        },
        {
          "id": "obs-3.2.0",
          "project": "OBS Blade",
          "packageName": "com.kounex.obsBlade",
          "versionName": "3.2.0",
          "versionCode": "2023012003",
          "size": 26795730,
          "sha256": "5c9397cf32cf9766797e033426384e72fe9289c865c11ff14d50413edbbbb116",
          "sourcePage": "https://github.com/Kounex/obs_blade/releases/tag/foss-3.2.0",
          "channel": "developer-github",
          "signatureSchemes": [
            "v1",
            "v2"
          ],
          "signers": [
            {
              "sha256": "9183c56b5518a3215d18c0fe9e244d64a1a94917dd4df86019c46ad7a7f03ac1",
              "certificateKind": "android-debug",
              "notBefore": "2023-05-02T11:32:48Z",
              "notAfter": "2053-04-24T11:32:48Z"
            }
          ],
          "verifiedLineageSegments": 0
        },
        {
          "id": "obs-4.2.0",
          "project": "OBS Blade",
          "packageName": "com.kounex.obsBlade",
          "versionName": "4.2.0",
          "versionCode": "2026102003",
          "size": 76152057,
          "sha256": "13ee8eb4feb5185d27be01b09696c30c7d0da8e6badb3c730cf6b5cae6c62d17",
          "sourcePage": "https://github.com/Kounex/obs_blade/releases/tag/foss-4.2.0",
          "channel": "developer-github",
          "signatureSchemes": [
            "v2"
          ],
          "signers": [
            {
              "sha256": "dacd5fe5e0e07a61ead879829101c36d664e56c5af269f6e9789e102c64a4c19",
              "certificateKind": "named-certificate",
              "notBefore": "2026-10-22T09:00:50Z",
              "notAfter": "2076-10-09T09:00:50Z"
            }
          ],
          "verifiedLineageSegments": 0
        }
      ],
      "transitions": [
        {
          "fromId": "obs-2.1.0",
          "toId": "obs-3.2.0",
          "fromVersion": "2.1.0",
          "toVersion": "3.2.0",
          "previousSigners": [
            "1ae300a84a6581ddcd430c125860b2444625291d37565ae43b25469ede1a8662"
          ],
          "currentSigners": [
            "9183c56b5518a3215d18c0fe9e244d64a1a94917dd4df86019c46ad7a7f03ac1"
          ],
          "classification": "unexplained-change",
          "notice": null
        },
        {
          "fromId": "obs-3.2.0",
          "toId": "obs-4.2.0",
          "fromVersion": "3.2.0",
          "toVersion": "4.2.0",
          "previousSigners": [
            "9183c56b5518a3215d18c0fe9e244d64a1a94917dd4df86019c46ad7a7f03ac1"
          ],
          "currentSigners": [
            "dacd5fe5e0e07a61ead879829101c36d664e56c5af269f6e9789e102c64a4c19"
          ],
          "classification": "first-party-announced-key-replacement",
          "notice": {
            "sourceUrl": "https://api.github.com/repos/Kounex/obs_blade/releases/tags/foss-4.2.0",
            "releasePage": "https://github.com/Kounex/obs_blade/releases/tag/foss-4.2.0",
            "accessedDate": "2026-11-11",
            "snapshotSha256": "24150207487ab2afbba8913b4d2f536bc509407e04bba9ba0e8ba0eb3955884c",
            "explanation": "The developer's 4.2.0 FOSS release notes say the build uses a new signing key and users coming from 3.2 must uninstall it before installing 4.2."
          }
        }
      ]
    }
  ]
}