It seems another design could have been used, that would likely have been more work but wouldn't rely on getting private signing keys.

For instance, the OS could have a carve out for these shims that allows a Google-signed app to overwrite an app, but without access to its local data. Then that overriding app could delete itself when the original is re-downloaded.