gplay signing (self-hosted Play App Signing key)

Two experimental commands, signing enroll and signing rotate, both irreversible and --confirm-gated. They drive the appsigning API for apps whose signing key lives in the developer's own Google Cloud KMS instance. Shared conventions are in gplay-cli-usage.

The wall: self-hosted keys only

The API handles self-hosted KMS keys only; a Google-managed key is enrolled and rotated in the Play Console. When the user has no Cloud KMS key, point them at the Console and stop. The IAM prerequisite on the key is in enroll --help.

Enroll

# an app that has already published to Open testing or Production
gplay signing enroll --kms-key projects/p/locations/l/keyRings/r/cryptoKeys/k/cryptoKeyVersions/1 --confirm