Are Android updates signed with Google's private key or other signing techniques? I noticed that Android pops automatically for new updates and patches.

Are these updates signed so that the device knows it's from the official publisher and not from some server spoofer?
Are updates digitally signed before being shipped?


Yes, updates are cryptographically signed by the publisher. This is to ensure the integrity of the update, both from unintentional corruption during the transmission, and willful manipulation from an attacker.


  Who signs the updates? Is it Google?


That depends on who publishes updates for your phone. If you own a Nexus or Pixel phone, then the update is likely published and signed by Google. 

Other manufacturers, such as Samsung for instance, modify Android before shipping it. This may include their own system applications, their own launchers, etc.. In such cases, the manufacturer is the publisher of the update and thus responsible for signing it.


  But isn't Google the one who develops Android?


It's not Google alone, it's the OHA - Google just happens to be their most prominent member. Furthermore, Android is Open Source, meaning that contributions come from many different companies and individuals, not just Google.