First of all, the key for the signed telemetry files is stored inside the FlightMode.apk. A very lousy way to secure data. On the other hand, installing apps on an android devices does not necessarily require Google Play on the device. It can also be done with the Yuneec GUI.
But you are right in general, I would not risk any damage to my copter because I implemented a wrong behaviour in my apps. I don't believe that Yuneec will ever release a SDK which allow to take control over the copter. However, it would be fine for me, if I could at least read the telemetry from the ST10+ without removing the SD card or forward the video signal from the remote to a connected smartphone. This way, you could easily manage far distance connections with mobile devices.
Anyway, the camera API is almost completely known and if I had an typhoon H, I believe, that I could also manage it to find out the protocol for the 360 gimbal. I think, that the second radio only connects to the camera rather than the copter. This means, that the camera is able to send commands to the gimbal. The code proves that.
Well if you want to sign something, you have to have the key somewhere on you

I'm obviously interested in making it easy to install and upgrade apps ( http://www.feertech.com/flightcenter.html ) and also be paid for them if people find them useful. Flight Center solves the problem of getting telemetry off the ST-16 without swapping SD cards around, and it fixes Yuneec's format so it plays nicely with other software. There's a lot more I want to add, but without a little support from Yuneec it's very hard to justify the development time.
If Yuneec are interested in third party apps, if they want a healthy ecosystem like DJI enjoy, they have to actively engage with developers. If any of the forum members speak with Yuneec representatives, please remind them that!
I've not looked too closely at the camera API on the Typhoon yet. The gimbal pitch and yaw controls on the ST-16 show up as channel values in the remote telemetry logs alongside the normal flight channels, so it's not at all clear to me 'who has control' on the Typhoon itself. The camera controls (start record etc.) don't show up in the same files. Hmmmm..