Shipping the Android app is now a tag push. CI builds the release APK, signs it with the release keystore (held as a CI secret, never in the repo), computes a SHA-256 checksum, and attaches both to the GitHub Release for that tag.
No hand-built APKs, no "which machine has the keystore" problem, and anyone sideloading can verify the checksum against the Release page before installing.