A developer stores the private key for mTLS client authentication directly inside the Android APK as a PEM file in the assets/ folder. What is the specific risk, and what is the correct approach?

• A.A) The assets/ folder is not compressed, causing a performance penalty; the key should be in res/raw/ instead
• B.B) Any user can extract the private key by unzipping the APK file (APKs are ZIP archives); if the key is extracted, any device can impersonate the app to the server. The correct approach is to generate the key pair on-device using the Android Keystore and export only the public key/CSR to the server for certificate issuance
• C.C) PEM format is not supported by Android TLS libraries; the key must be in PKCS#12 format
• D.D) The assets/ folder uses a different file protection class from internal storage, making it accessible to any other installed app