Which I also don't like, but at least that can be done offline. The signature could be verified on device without sending everything to Google. If they have to track the 20 seats for the hobbyist accounts then they have to be tracking every single install

But they're not. They're actually sending each signature to Google and asking whether that's been verified anyway.