A developer stores the private key for mTLS client authentication directly inside the Android APK as a PEM file in the assets/ folder. What is the specific risk, and what is the correct approach?

• A.The assets/ folder is stored uncompressed inside the archive, and that always costs extra read latency at startup (the aapt2 packer skips deflate for assets); res/raw/ is the right home for a PEM key, giving both compression and the resource-id indirection that keeps it out of a casual unzip listing
• B.The assets/ folder carries a different file protection class from internal storage, and every installed package can open it through the AssetManager API (no permission declaration is needed); the fix is to copy the PEM into /data/data/<pkg>/files at first launch, where DAC applies
• C.Any user can extract the private key by unzipping the APK file (APKs are ZIP archives); if the key is extracted, any device can impersonate the app to the server. The correct approach is to generate the key pair on-device using the Android Keystore and export only the public key/CSR to the server for certificate issuance