What is the security risk of storing a mTLS client certificate's private key in an Android app's assets/ folder packaged inside the APK, even if the file is named with a misleading extension like 'config.bin'?

• A.A) There is no risk because the assets/ folder files are compiled into native code by the Android build system
• B.B) APK files are ZIP archives; anyone can extract assets/ by unzipping the APK, and file extension renaming provides no protection - the private key can be recovered and used to impersonate the app
• C.C) The assets/ folder is protected by the Android Keystore encryption layer, making the file secure even if the APK is extracted
• D.D) The misleading extension triggers Android's malware scanner, causing the app to be flagged on Google Play