Google Play应用签名密钥升级后签名证书适配版本异常问题咨询

我想用自有证书给应用签名，发布后已经在Google Play Console完成了应用签名密钥升级。但从Google Play下载导出APK后，用apksigner verify -v --print-certs ~/Desktop/my.apk命令查看证书信息，输出如下：

Verifies
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): true
Verified using v3.1 scheme (APK Signature Scheme v3.1): true
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate DN: CN=***, OU=myname, O=***, L=***, ST=***, C=***
Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-256 digest: *******4cd54be39f12785a80a7baf
Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate SHA-1 digest: *******fc6b66a9416da89169465
Signer (minSdkVersion=33, maxSdkVersion=2147483647) certificate MD5 digest: *******556b3cf266b2bc2741cf6
Signer (minSdkVersion=33, maxSdkVersion=2147483647) key algorithm: RSA
Signer (minSdkVersion=33, maxSdkVersion=2147483647) key size (bits): 2048
Signer (minSdkVersion=33, maxSdkVersion=2147483647) public key SHA-256 digest: 897a4860c3f2bb2ce4b9d4e687774394d776d6a624b84e78d47eb8cb0cb84189
Signer (minSdkVersion=33, maxSdkVersion=2147483647) public key SHA-1 digest: ef4e19e9869be1e469484b1cb9a15abdec1ffedd
Signer (minSdkVersion=33, maxSdkVersion=2147483647) public key MD5 digest: 53d0af1be1c494da91512013ac715e38


Signer (minSdkVersion=24, maxSdkVersion=32) certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-256 digest: a467d5b26721543e4497d2f13a8bb1ad2fda43a3c465cfa68aab1c788f6b1122
Signer (minSdkVersion=24, maxSdkVersion=32) certificate SHA-1 digest: 0064b9fda8a3607caffb40ee9cb473281a075506
Signer (minSdkVersion=24, maxSdkVersion=32) certificate MD5 digest: 21c559262c1eff96efca2e48838a4338
Signer (minSdkVersion=24, maxSdkVersion=32) key algorithm: RSA
Signer (minSdkVersion=24, maxSdkVersion=32) key size (bits): 4096
Signer (minSdkVersion=24, maxSdkVersion=32) public key SHA-256 digest: 6af34c08a9c2d16f1ad3778a4540f8582bc3f73f9079628a1f9fa91169dc24d9
Signer (minSdkVersion=24, maxSdkVersion=32) public key SHA-1 digest: b0f5300c9270f35ee0a12d5c1632dc96089a047a
Signer (minSdkVersion=24, maxSdkVersion=32) public key MD5 digest: 868505b614e176b68c539f2f64f64091

Source Stamp Signer certificate DN: CN=Android, OU=Android, O=Google Inc., L=Mountain View, ST=California, C=US
Source Stamp Signer certificate SHA-256 digest: 3257d599a49d2c961a471ca9843f59d341a405884583fc087df4237b733bbd6d
Source Stamp Signer certificate SHA-1 digest: b1af3a0bf998aeede1a8716a539e5a59da1d86d6
Source Stamp Signer certificate MD5 digest: 577b8a9fbc7e308321aec6411169d2fb
Source Stamp Signer key algorithm: RSA
Source Stamp Signer key size (bits): 4096
Source Stamp Signer public key SHA-256 digest: 4c53c1d28f2ecceadcb1351603f0b702615b3454b6e30070de759359f241b802
Source Stamp Signer public key SHA-1 digest: 188b067a9ee881bde55dabe0f8f7ecb320b1a091
Source Stamp Signer public key MD5 digest: 965afac83f033aa037a54482eb6922d5

发现自有证书只覆盖minSdkVersion=33到maxSdkVersion=2147483647的版本，而Google Play的证书覆盖minSdkVersion=24到32（Android 7到13）的版本，这是为什么？

• 这是Google Play应用签名密钥升级后的版本分段签名机制导致的：当你完成自有密钥升级后，Google Play会针对不同Android版本范围的APK，使用对应的签名密钥重新签名。
• 对于Android 13（API 33）及以上版本的APK，Google Play会直接用你上传的自有证书签名，因为这些系统版本支持验证自定义签名的完整流程，能识别你的自有密钥。
• 对于Android 7到12L（API 24到32）的APK，Google Play依然使用它原来的应用签名密钥签名——这是因为旧版本系统对签名密钥变更的兼容性限制，避免这些版本的设备无法识别新的自有证书，导致应用验证失败、无法安装或运行。
• 这种分段处理是Google Play的默认逻辑，目的是在切换自有签名密钥的同时，保证所有历史支持版本的应用兼容性，不会因为密钥升级导致旧版本用户无法正常使用应用。

内容的提问来源于stack exchange，提问作者ikool