Private keys cannot be verified in recovery
From the code comments:

// ... Verify it matches one of the given public
// keys.


You can't just use any old signature, that would defeat the purpose.  APKs, on the other hand, are intended to be created and distributed by anyone and the signature is ostensibly to verify the source rather than limit the source.