That's indeed what we do in our CI but it gets very hairy and the end result is often subpar in nuanced ways. E.g. signing a bundle which required us to upgrade

That's indeed what we do in our CI but it gets very hairy and the end result is often subpar in nuanced ways. E.g. signing a bundle which required us to upgrade our whole CI infrastructure because we had to move to a newer VM. The bundle is huge because it needs to include a JRE and JavaFX. The install process and bundle building is complex. Especially with signing. And you need to do it all for every platform.