I don't think that's a good idea. At least not in general. Signing only proves the identity of whoever signed it. It doesn't say whether the signers infrastruct

I don't think that's a good idea. At least not in general. Signing only proves the identity of whoever signed it. It doesn't say whether the signers infrastructure was infected at the time between compiling and signing. Granted. Google is probably safe. But can you tell that for every thirdparty vendor who has a code signing certificate (they are quite easy to get)