Background
A production app that had been stable for a long time suddenly received many reports that Google Sign-In no longer worked. The app had not been updated recently, so the failure was unexpected.
Error log
Testing on my own phone produced:
1 | signInResult:failed code=com.google.android.gms.common.api.ApiException: 12500: |

I used the error log to investigate the common causes:

Resolution
After verifying all likely configuration problems, I found nothing incorrect in the app. I re-entered the SHA-1 fingerprint in Google Cloud Console, saved the configuration, and refreshed it. Google Sign-In then worked again.
My personal conclusion was that the platform configuration had become inconsistent. Only this one app was affected; the other apps continued working normally.