I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.

Some proof: https://verify.contentauthenticity.org/?source=https://retr0...

I could also paste a privkey + cert chain in here but el goog's lawyers might not like that.