The Application is a fully fledged actor, even with it's own public key so it could sign activities it sends, theoretically. I've not seen that happen in the wild, tho.