Answer
Create a keystore, then reference it via MSBuild properties (AndroidKeyStore, AndroidSigningKeyStore, alias, and passwords) or use Play App Signing. Keep the keystore and passwords secret (CI secret store). The signature identifies the app; losing the key can prevent future updates unless Play App Signing manages it.
dotnet publish -f net8.0-android -c Release \
-p:AndroidKeyStore=true \
-p:AndroidSigningKeyStore=my.keystore \
-p:AndroidSigningKeyAlias=mykey \
-p:AndroidSigningStorePass=env:STORE_PASSReal-world example Release builds are signed in CI using a keystore pulled from a secret manager, never committed to source control.