I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we could go to an asymmetric system. The key issue is that we want to keep the keys in the APK somehow but store them securely. That way we don't have to make a server request for these private keys or a partner key in an asymmetric system. The APK file itself is fairly easy to reverse engineer and decompile, including the resources and the Java code.
We are using a C library in our application, however. We are using a .so file of this library compiled for the ARM architecture. We use the SWIG interface from our application's main Java code to interact with this library. I am wondering if I can store the private keys in this library's source code and then access these keys via SWIG binding functions. I think this is the best solution for my problem because ARM .so files require a fancy commercial decompiler and knowledge of the ARM architecture to effectively reverse-engineer them. Thus making this method of getting the private keys pretty darn secure.