application or code signing is the process of generating private and public keys and public-key certificates, signing and optimizing the application.
Permissions are an Android platform security mechanism to allow or restrict application access to restricted APIs and resources. By default, Android applications have no permissions granted, making them safe by not allowing them to gain access to protected APIs or resources on the device. Permissions must be requested, customized permissions defined, and file and content providers protected. Be sure that you check, enforce, grant, and revoke permissions at runtime.
Next, look at each of the security areas in more detail.