APKs - How To Spot Fake Signatures

How do you know that an APK signature is not a fake?

What is to stop somebody unpacking an APK, inserting malicious code, repacking the APK, and signing it with a new key that simply copies all of the fields from the original publishers key (company name, locations, etc...)? Obviously it is not the same key, but all of the data the end user would see appears to be the same.

If the original key had to be signed by a trusted authority (as is the case with trusted ClickOnce applications for instance), you could have some certainty that this key was issued to the original company. Similarly, if publishers made their public keys available from a trusted outlet (e.g. google.com/android/keys) you could check that they were correct from the fingerprint.

It would appear that signing only gives you the illusion of security, which is actually worse than no security at all.