We are developing an app which stores secrets using Android KeyStore. It is important for us that these secrets cannot be replicated to other devices. The user indirectly pays for the utility of this secret and if it can be copied to another device then our customers can technically avoid paying us.
We have tried to install a new phone using google built in "copy data and apps from old phone". In this case we didn't see the secrets transferring from the old phone to the new one. We have however gotten reports about customers using custom apps to copy data from one phone to the other where the secrets "work" on the new phone.
Are there any apps out there that can copy the phones Keystore into a new phones Keystore? Should we be worried about this?