It doesn't. They are adding a way to check for hashes against a "trusted database", but afaik not live yet 

 Keep in mind that this is only needed for first installs 

 What do you mean "only for first install"? Shouldn't you verify packets at every release? 

 No, Android checks that for you. It's a bit like SSH (trust on first use) 

 Oh wow didn't know that. Guess I have something new to learn now, thanks. 

 It doesn't but if you are provided a malicious update to an already installed app android handles the verification and will prevent the installation of the update if it was not signed by the developer.

The first installation is only time you usually risk a mitm attack