What the install dialog actually surfaces
The Android install dialog is short on purpose. It shows the app label, the package name and the version, all drawn from the developer's manifest. The signing certificate is not on the screen. Runtime permissions arrive later, at the moment the app calls the relevant API. Special-access permissions live under Settings › Apps › Special access.
- Treat the app label as a self-asserted string, not a verified publisher.
- Use
apksigner verify --print-certsto read the signing certificate. - Refuse runtime prompts at the moment they appear, not at install.
- Audit special-access toggles in Settings › Apps after install.
- Compare a SHA-256 only when the publisher publishes one.



