An app's signature proves its origin and guarantees that it has not been modified. On Android, you sign with a key kept in a keystore; on iOS, with a certificate and a provisioning profile. This key must never be lost nor published in the repository.