1. Strongly recommend using Google Play App Signing — if your app signing key is lost, Google can help restore it; 2. Store upload keys separately from app signing keys — never share them; 3. Use hardware security modules (e.g. YubiKey) to store app signing keys — never store keys in cloud storage, code repositories, or unencrypted drives; 4. If multiple developers need access, set up key rotation procedures and use Play Console's key management features; 5. If your upload key is compromised, immediately request a reset via Play Console → Setup → App Integrity → Upload Key; 6. Generate a new upload certificate (valid 25+ years) and register the SHA-256 fingerprint in Play Console; 7. Google Play App Signing supports both app signing and upload key rotation — rotate proactively every 2–3 years as a security best practice.