I just enrolled to App Signing in Play console and everything works great.
But how should I treat my new upload keystore and its passwords now? Can I just put this keystore under version control and put passwords into build script in plain text?
As I understand this keystore is only used to temporary sign my apk prior to upload. So I consider it to be pretty safe, since nobody except myself can actually upload new apk to Play, and there is no option to access my original release keystore by knowing upload keys.
Another thing that bothers me now is that I can't see any option to change upload keystore. Is it possible now, or at least planned to be added to Play console soon? If I'll publish my upload keystore and passwords to version control it would be nice to have an option to switch to a new private keystore, if something will go wrong.