The file's bytes are read as data only — nothing in an uploaded APK is ever executed. A verified signature proves the file is genuinely signed by whoever holds that certificate's private key; it does NOT prove that certificate belongs to who it claims to be (a self-signed debug build verifies exactly as cleanly as a real release key). This also does not recompute Android's full content digest end to end.