fix build fingerprint: dev-keys vs test-keys

The fingerprint should only say dev-keys if it's actually using custom
keys; builds with the old default (from build/target/product/security)
should still say test-keys.

Change-Id: Ib8c662c348cf63f5db47e2f8f81bc3246cb15fdc
diff --git a/core/Makefile b/core/Makefile
index 3186bda..ba243ff 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -71,9 +71,16 @@
 ifeq ($(TARGET_BUILD_TYPE),debug)
   BUILD_VERSION_TAGS += debug
 endif
-# Apps are always signed with dev keys, and may be re-signed in a post-build
-# step.  If that happens, the "dev-keys" tag will be removed by that step.
+# The "test-keys" tag marks builds signed with the old test keys,
+# which are available in the SDK.  "dev-keys" marks builds signed with
+# non-default dev keys (usually private keys from a vendor directory).
+# Both of these tags will be removed and replaced with "release-keys"
+# when the target-files is signed in a post-build step.
+ifeq ($(DEFAULT_SYSTEM_DEV_CERTIFICATE),build/target/product/security/testkey)
+BUILD_VERSION_TAGS += test-keys
+else
 BUILD_VERSION_TAGS += dev-keys
+endif
 BUILD_VERSION_TAGS := $(subst $(space),$(comma),$(sort $(BUILD_VERSION_TAGS)))
 
 # A human-readable string that descibes this build in detail.