Note this can practically only be enforced by apps that communicate with a server. For pure client side apps, one can simply patch the code (albeit this won't give them access to the saved data due to signature mismatch).

However, Google is developing a new obfuscation method called pairip (officially automatic integrity protection) that makes it really hard to patch apps by moving some java code to an encrypted vm riddled with checksums and anti debugging checks.. Fortunately "really hard" (and yes, the vm is crazy..) doesn't mean impossible.

But for server side services, this will unfortunately serve its purpose.