I am putting it inside my application. Can they unzip apk and reach it?
is so how should is store it?
What do you mean by “inside”? If you mean you put it somewhere inside the Assets folder of your project, Unity only includes assets in a build that are used / referenced somewhere. Since the keystore file usually isn’t recognised as asset by Unity.
Besides that your keystore shouldn’t be saved with a project at all. Your keystore represents your identity. You should only have one. Keep in mind you need the exact same keystore to post updates. You can’t recreate a keystore.
Of course you could create a seperate keystore file for each project, but in this case, store it outside the Assets folder just to be on the safe side.