Probably not the signing keys, otherwise they could have uploaded a malicious app with the original package name.