code from cloud-messaging/android/client#manifest
<permission android:name="<your-package-name>.permission.C2D_MESSAGE" android:protectionLevel="signature" />
<uses-permission android:name="<your-package-name>.permission.C2D_MESSAGE" />
code from cloud-messaging/android/client#manifest
<permission android:name="<your-package-name>.permission.C2D_MESSAGE" android:protectionLevel="signature" />
<uses-permission android:name="<your-package-name>.permission.C2D_MESSAGE" />
Because google says so? :)
It is so that the app declares a dependency which is then auditable and viewable by the user. And if you are wondering why some permissions must be explicitly requested and how it is decided which permissions are dangerous and which not (and hence should be explicit) -- that's a call that Google, as the owner of the Android platform, has made. Obviously, those choices are driven by adoption rates, a component of which is consumer's demand for transparency, so there's a loose feedback from app users into those choices but ultimately Google makes such decisions opaquely. We can only guess.