Signature spoof require specific permission and it's only available for system apps. So there is no way any app can abuse it unless you specifically allow it.