Checksums != signatures For free, the author could simply GPG sign all releases for all platforms and suggest users verify them. Then, the decision to run untr

Checksums != signatures For free, the author could simply GPG sign all releases for all platforms and suggest users verify them. Then, the decision to run untrusted code is the user's decision and bypasses platform monetization. Then, if suffient and continual contributions of money and expertise permit, official codesigning per platform could be added as another layer (defense-in-depth).