Even if you allow package distribution whitelists, and even if we allow Google, by virtue of essentially owning/steering Android to, by default, be on the whitelist in their distributions...

At some point you need to just let the user say "I'm OK with being accountable for the installation" and get out of the way.