securitypunk
Joined 5 years ago
Karma
13
Submissions
6
Member since
Jun 26
Joined 5 years ago
From a consumer perspective, going with A and trusting the company is by far the safest option.
This is a natural evolution of the format. It's good for the ecosystem. Whatever guarantees were supposedly provided by having developer (poorly) store their own signing keys are better handled by Google's own infrastructure.