Signature and reinforcement are two different things. Signature is still a basic keystore signature. This must be in your own hands. If the signature file and signature password are exposed, it is equivalent to making the application you made in vain and letting others replace your application. . Each company has its own implementation of reinforcement, and uses some algorithms to change the dex file so that it cannot be easily decompiled.