Doesn't this make it prohibitively difficult to do local builds of open source projects? It's been a long time since I've done this, but my recollection was that the process to do this was essentially you would build someone else's (the project's) package/namespace up through signing, but sign it locally with your own dev keys. A glance at the docs they've shared makes it sound like the package name essentially gets bound to an identity and you then can't sign it with another key. Am a I misremembering and/or has something changed in this process? Am I missing something?
I think anyone who works as a dev knew this was Google's endgame the moment they started circling the wagons with the app bundle stuff. It was already getting weird before that, but it was uncharacteristically out of step with historic Android.