title: Why CERT.SF file is need to verify an apk in android?
body: <p>As we all know, MANIFEST.MF contains sha1-digest encoded in base64 for all the files in apk, CERT.SF contains sha1-digest of file MANIFEST.MF and all items in it, and CERT.RSA contains signature for file CERT.SF and a certification.</p>
  
  <p>Here is the question:
  Why not just sign MANIFEST.MF and save the signature in CERT.RSA directly?</p>