Section 11: The Most Valuable Pipe on Earth - Security & Supply-Chain Trust

Executive Summary: An app store is a code-execution channel into 3 billion phones, and 120 billion installed apps will accept whatever it delivers under the right signature as "the next version." This section treats trust as the system's spine. We name six attackers, trace the chain of trust from Trailhead's upload key to Priya's Pixel 7, treat the CDN as untrusted transport, defend store-held signing keys in HSMs, put a two-person rule on the store's own dangerous buttons, and plan disaster recovery so a dead signer pauses new releases without stopping a single download.

The Threat Model Comes Before the Controls

Interviewer: "Section 10 touched on a malicious update. Let's go all the way. Who is attacking this system?"

You: "Anyone who wants to run code on a billion phones without asking. I'd list six attackers by where they enter the pipe: someone who takes over a developer's account, someone who steals a signing key, a malicious insider at the store, a compromised build-and-sign pipeline, a CDN or network that tampers with bytes, and a malicious app that simply passes review. Each gets a control, and each control a residual risk."

The target is the invariant from Section 2: a device only ever installs bytes the store signed for that app, and an app's signing identity never changes silently. Every control below defends one half of that sentence.