support APK v3.2 signers with Post-Quantum algorithms

Hans-Christoph Steiner
2026-04-02T13:17:59Z

The `signers` are important for signature compatibility and `AllowedAPKSigningKeys:`. This should support this new v3.2 signature scheme.

https://developer.android.com/about/versions/17/release-notes
> Post-Quantum Cryptography (PQC) Hybrid Signing: Android introduces the v3.2 APK Signature Scheme, combining classical signatures (RSA/Elliptic Curve) with ML-DSA signatures. This prepares apps for NIST standards and quantum computing advancements.

https://security.googleblog.com/2026/03/post-quantum-cryptography-in-android.html

@uniqx Could you estimate how much work it would be to add support for the v3.2 certificate extracting and fingerprint generation in Androguard?

@grote have you looked into that at all?