if a ROM is building superuser (vs embedding it into Settings), put the package into a com.thirdparty.superuser
This is so that it doesnt try to get updates from google play, which will be signed with a different key.