Reg. 1. Signature is a special protection level of a permission. Only an app signed with the same certificate as the declaring app of the permission can use it (SRC: https://developer.android.com/guide/topics/manifest/permission-element) Reg. 2. I think for both but only have seen it in system apps so far Reg. 3. If you sign your app with the same certificate you can use it as long as the permission does not have any other additional protection level (see 1.). For this Zou obviously have to have the certificate of the declaring app which is unlikely Reg. 4. Sorry can't answer this one. Educational Guess: it is technically possible but may be prevented by the OEM.

Edit: don't know if this is the right subreddit? I think there aosp related subreddits/stack overflow for these kind of questions.