title: Implement signature-level security on Android services with more than one allowed signature
body: <p>I'm developing on an application at the moment which contains quite a lot of personal user information - things like Facebook contacts, etc ... Now, one of the things I want to be able to do (and have done, quite effectively) is open up parts of the application to "3rd Party" applications, using Android's build-in inter-process communication protocol (AIDL). So far so good.</p>
  
  <p>Here's the catch: because we're involved in handling quite a lot of personal information, we have to be quite careful about who can and can't access it; specifically, only "Trusted" applications should be able to do so. So the natural way to do this is to use a custom permission within the AndroidManifest.xml file where we declare the services. My problem is this: I want to be able to enact signature-level protection (similar to the normal "signature" permission level), but with a bit of a catch:</p>
  
  <p>I don't <em>only</em> want application signed with our internal signature to be able to access the services. I'd like to be able to build a list of "trusted signatures" &amp; at runtime (or if there's a better way, then maybe some other time?) be able to check incoming requests against this list of trusted keys.</p>
  
  <p>This would satisfy the security constraints in the same way as the normal "signature" permission level I think - only programs on the "trusted keys list" would be able to access the services, and keys are hard to spoof (if possible at all?) - but with the added bonus that we wouldn't have to sign every application making use of the APIs with our internal team's key.</p>
  
  <p>Is this possible at the moment in Android? And if so, are there any special requirements?</p>
  
  <p>Thanks</p>