Both the package and the index is signed actually. That's why it still works when installing APK files directly