Recent AOSP repo added lines of code to Package Installer to handle enforcing restricting whether Package Installer installs an APK file or not based on dev signatures, as well as denying installation if internet isn’t available so it can’t contact Google’s servers for dev signature verification.

So this is enforced by Package Installer, which is already how Google enforces their ridiculous minimal SDK version requirement for installing APK packages, as well as for updating an app with an APK package with mismatched signature or blocking downgrading an existing app with an APK package, which I already have bypassed via Xposed this way.