Adium definitely gets its update list over HTTP, so maybe it just prompts the user if the signatures don't match and lets them install anyway? The relevant mod

Adium definitely gets its update list over HTTP, so maybe it just prompts the user if the signatures don't match and lets them install anyway? The relevant module in evilgrade is sparkle.pm if you want to check it out.