Working with Security Metadata in APK file According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK file.

I have some questions regarding this:

(1) How did Google insert this the metadata into APK signing block of the APK and how it verifies that metadata on the phone (technically)? 

I guess it is possible to create custom content in this signing block? Let's say I want to distribute some APK privately in my company, when the user installs that APK then I can figure out if the APK belongs to our company or not, just like Google did with their apps in Play Store.

(2) If all developers use App Signing by Google Play, then does the mentioned security metadata above become unnecessary? Because Google can just simply verify the certificate inside each APK instead.

My apologies for the shallow understanding. Any comments are highly appreciated!
How did Google insert this the metadata into APK signing block of the APK and how it verifies that metadata on the phone (technically)?


Technically the Google "Frosting" signature is inserted the same way as described in the APK Signature Scheme v2. Note that it is just added to the same section inside the ZIP file - it does not replace any existing signatures in this section.


  I guess it is possible to create custom content in this signing block? Let's say I want to distribute some APK privately in my company, when the user installs that APK then I can figure out if the APK belongs to our company or not, just like Google did with their apps in Play Store.


As far as I know the only "meta data" is the signature itself. If it is present it is an APK from Play Store.


  If all developers use App Signing by Google Play, then does the mentioned security metadata above become unnecessary? Because Google can just simply verify the certificate inside each APK instead.


No. The Google Frosting signature is just an additionally signature. The Android permission model still relies on the common APK signature by the developer. Only the Google Play Store app is able to verify the Google frosting signature. The other parts of the Android system (those from AOSP) don't even recognize this signature.

For more technical details see this question + answers on Stackoverflow: Security Metadata in Android APK