From Android In App Billing version 3 (TrivialDrive)sample application coming with sdk
/* base64EncodedPublicKey should be YOUR A
Is someone is really need you private key? I think the whole idea is replace it. IMHO any manipulations are useless. The only thing to do by evil person is just initialize variable with correct (his own key) value one line begore google API call.