Confirm that we are signing and verifying updates

[holmesworcester]

A security-minded colleague wanted to make sure that we were signing and verifying updates as signed by us, separately from the macOS gatekeeper and equivalent windows code signing that verifies we are a known developer.

It wasn't immediately obvious whether we were doing this, so I'm creating an issue to track it.

Resolving this issue may be as simple as confirming that we're signing and verifying signatures on updates. If we aren't, we should enable that.