[a2128]

This is a drastic misrepresentation of the situation. All Android apps already have code signing, you cannot install an app unless it has a signature, and any future updates are blocked unless the signature matches. This is how it's been practically since the start of Android, it's part of the security model to prevent something like a malicious Firefox APK stealing your cookies.

What's new is that they were gonna block installations outside of Google Play, unless the developer has signed up for Google Play Console and has gone through a verification process there, whitelisting their signing key fingerprint. However, they've walked back on this and said they'll create a new "advanced flow" for "advanced users" that's "designed to resist coercion" to bypass this restriction. Door in the face technique IMO, the existing 12-step process to installing an app was already complicated enough.

So effectively the result is that file based installations will be blocked unless Google has specifically whitelisted their key through the Google Play Console verification process, or the user goes through this "advanced flow" which we're yet to see any details of