title: How do I verify an official Google apk
body: <p>With all of the rooting and custom mods out there for android, it makes me nervous that some of the apks that state they are google's are actually malicious.</p>
  
  <p>So in trying to verify them I've extracted an ANDROID.RSA public key and I have been trying to verify it online.. but every google search turns up methods of doing public key encryption on android and not how to verify actual google apks</p>
  
  <p>So my basic question is:</p>
  
  <p>How do I verify that a google apk is actually a google apk?</p>
  
  <p>The one particular RSA public key I found:</p>
  
  <pre><code>Owner: CN=Google NFC, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
  Issuer: CN=Google NFC, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
  Serial number: a8cd17c93da5d990
  Valid from: Wed Mar 23 21:06:53 EDT 2011 until: Sun Aug 08 21:06:53 EDT 2038
  Certificate fingerprints:
       MD5:  C9:E9:71:21:25:5D:E0:15:6F:3F:5B:24:B1:A8:47:6A
       SHA1: 82:75:9E:2D:B4:3F:9C:CB:AF:CE:31:3B:C6:74:F3:57:48:FA:BD:7A
       Signature algorithm name: SHA1withRSA
       Version: 3
  
  Extensions: 
  
  #1: ObjectId: 2.5.29.14 Criticality=false
  SubjectKeyIdentifier [
  KeyIdentifier [
  0000: 1C CE CE 0E EA 4D C1 12   1F C7 51 5F 0D 0A 0C 72  .....M....Q_...r
  0010: E0 8C C9 6D                                        ...m
  ]
  ]
  
  #2: ObjectId: 2.5.29.19 Criticality=false
  BasicConstraints:[
    CA:true
    PathLen:2147483647
  ]
  
  #3: ObjectId: 2.5.29.35 Criticality=false
  AuthorityKeyIdentifier [
  KeyIdentifier [
  0000: 1C CE CE 0E EA 4D C1 12   1F C7 51 5F 0D 0A 0C 72  .....M....Q_...r
  0010: E0 8C C9 6D                                        ...m
  ]
  
  [CN=Google NFC, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US]
  SerialNumber: [    a8cd17c9 3da5d990]
  ]
  </code></pre>