APK download: sideload install with SHA-256 hash for verification

What the APK signing key looks like

The APK is signed with the desk's release key; the key is a 4096-bit RSA key held in a hardware security module. The desk publishes the SHA-256 hash of the signing certificate on the editorial standards page. The hash is regenerated only when the signing key is rotated; the desk has not rotated the key in the last three years and has no plans to do so in the next twelve months.

What the reader can verify: the SHA-256 hash of the APK file should match the value published here. The hash of the signing certificate should match the value published on the editorial standards page. If either hash does not match, the APK is not from the desk and the desk recommends not installing it.

What the sideload does and does not do

The sideload install is the same package that is published on the Google Play Store; the package is signed with the desk's release key and the package contents are identical. The sideload install does not require any permission beyond the permissions requested by the Play Store version; the desk does not add a "Pro" or "Premium" version of the app and the desk does not add any tracking SDK that is not in the Play Store version.

What the sideload does not do: the sideload does not bypass the Google Play Store's review process because the APK is the same package. The sideload does not enable any feature that is not in the Play Store version. The sideload does not give the reader any preferential access to the desk's content; the reading account is the same regardless of how the app was installed.

How to update the APK

The sideload install does not auto-update; the reader is responsible for downloading the new APK and re-installing it. The desk publishes a release note on the editorial standards page when a new version is published; the release note includes the new SHA-256 hash, the new features and the bug fixes. The desk recommends checking the editorial standards page once a month for a new release.

What the desk recommends for sideload users: set a calendar reminder for the first of every month to check the editorial standards page. The reminder is the cheapest way to stay current without enabling auto-update, which is not supported on the sideload path. The desk does not offer an email-based release notification for sideload users; the Play Store version does offer the notification, and the desk recommends switching to the Play Store version if the reminder is too easy to forget.