But even if you try to sideload a Google app to update it, it won’t install unless the signature used matches the original. So it doesn’t really matter where it comes from at this point, unless the Google certs to sign their apps got somehow leaked.