with the new system, you must go online to check if the license for that app is still valid or revoked. But the current system works almost the same: if there's an internet connection play protect checks the signature against an online malware db and prevents installation.

From a couple years ago, google has the power to remotely install/uninstall any apk on your phone without your consent

No, the certificate can be invalidated preventing future installations for other users. If you already have it you're SOOL