Maybe I want to know that someone was messing with stuff, and even if they put something 'back in place' that matches, I may still want to know that it was buil

Maybe I want to know that someone was messing with stuff, and even if they put something 'back in place' that matches, I may still want to know that it was built this morning and that something is going on. Of course code signing is going to mess that up.