What security risk does storing a server-side API private key inside a mobile app represent, and why is this categorically different from storing a symmetric API key in the app?

• A.A) There is no meaningful difference; both symmetric and asymmetric keys are equally protected when stored in the Android Keystore
• B.C) Private keys are longer than symmetric keys, causing APK size to exceed Google Play's 150 MB limit
• C.B) A private key inside a mobile app can be extracted and used to impersonate the server - anyone who extracts the private key could set up a fake backend that clients authenticate as legitimate. A symmetric API key only allows the client to authenticate to the server, not impersonate it. No private key should ever be distributed in a mobile app; keys should be generated on the server and the corresponding public key placed in the app for pinning
• D.D) iOS prohibits importing third-party private keys through the Keychain API, so they cannot be protected on iOS