That's what I'm wondering about too. Could they enforce verification by requiring you to put a signed "manifest" in your web app's root?

Here's hoping this will be a shot in the arm for PWAs.