Device manufacturers use “platform certificates” to verify an app’s authenticity, making them particularly dangerous in the wrong hands.
https://www.wired.com/story/android-platform-certificates-malware/
https://www.wired.com/story/android-platform-certificates-malware/