There's a related paper about that, too: http://www.cs.cuhk.hk/~cslui/PUBLICATION/ASIACCS2014DROIDRAY.pdf
P.S. Normal CyanogenMod builds are different from Installer builds and still signed with AOSP keys. To get Installer builds use the CyanogenMod Installer.
Re: Test-keys still used elsewhere
http://www.cs.cuhk.hk/~cslui/PUBLICATION/ASIACCS2014DROIDRAY.pdf
P.S. Normal CyanogenMod builds are different from Installer builds and still signed with AOSP keys. To get Installer builds use the CyanogenMod Installer.