Android embeds signatures in APK (and the old JAR) packages. It's not the question to check them automatically or not, but what's required to land in G play store.
With what G announced, a user can still install f-droid or another store and rely on them doing the checks prior to install. The problem I see more is that G is shifting responsibility for the less profitable part of the ecosystem they profit hugely from to third parties, who are doomed to update and roll with all android release changes, while neither having say or prior insight (re security) nor adequate resources to cope with a huge user base.
With what G announced, a user can still install f-droid or another store and rely on them doing the checks prior to install. The problem I see more is that G is shifting responsibility for the less profitable part of the ecosystem they profit hugely from to third parties, who are doomed to update and roll with all android release changes, while neither having say or prior insight (re security) nor adequate resources to cope with a huge user base.

