All debug variants are signed with same (custom defined) debug.key , each release variant has it's own specific {flavor}_release_keystore. No default debug.key (autogenerated from system) is used

build.gradle

signingConfigs {
        debug {
            storeFile file("debug.keystore")
        }

        releaseBlue {
            storeFile file('blue_release.keystore')
            storePassword "blueblue"
            keyAlias "alias_name"
            keyPassword "blueblue"
        }
        releaseRed {
            storeFile file('red_release.keystore')
            storePassword "redred"
            keyAlias "alias_name"
            keyPassword "redred"
        }
    }

    productFlavors {
        blue {
            applicationId "com.example.myapp.blue"
            versionName "1.0-blue"
            productFlavors.blue.signingConfig signingConfigs.releaseBlue
        }
        red {
            applicationId "com.example.myapp.red"
            versionName "1.0-red"
            productFlavors.red.signingConfig signingConfigs.releaseRed
        }
    }

    buildTypes {
        debug {
            applicationIdSuffix ".debug"
            signingConfig signingConfigs.debug
            // but if signingConfigs.debug is not defined in signingConfigs, default system debug.key would be used
        }
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
        }
    }

Guess it works like following:

1. in flavors is defined that blue should sign all its variants by using releaseBlue
2. same for red flavor. All red variants should be signed by using releaseRed
3. buildType debug comes after and it overrides all debug builds to used defined debug config for signing.

Result - Signing setup works as expected: all debug variants are signed with defined debug.keystore (none is signed with system debug.key), each release variant has its own release key with which is signed.

Notes:

• It feels a bit off, that we can signed each release with its own key, but it isn't possible to do the same with debug buildTypes.
• if signingConfigs.debug is not defined or it is defined "wrongly", system auto generated debug key is used
• defining signing config for specific flavor is global for all builds of that flavor, defining signing config for specific build is global for all builds of that type. Both stays so just if not overridden "later" in build.gradle