A developer wants to expose a background music playback Service to a companion smartwatch app. Both apps share the same signing certificate. What is the MOST secure access control approach?

• A.Set android:exported='false' on the Service and rely on the shared sharedUserId that always places both signed apps in one Linux UID; no permission declaration is needed for the watch companion to bind
• B.Declare a custom permission with android:protectionLevel='signature' and require it on the Service's manifest declaration; only apps signed with the same certificate can hold the permission
• C.Export the Service and validate the caller package name inside onBind with getCallingUid before returning the binder; a package name check alone is all the companion pairing needs
• D.Require the BIND_NOTIFICATION_LISTENER_SERVICE permission in the manifest and bind only from the watch; that permission is always restricted to preinstalled system packages