An empty SDK build-tools glob was reported as found, so the signer check ran nothing and refused a correctly signed APK with an empty signer. An unreadable signer now warns and defers to the host's pinned-cert check; only a real mismatch fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>