> You can only check parts of the binary, not the whole binary Not only would they be signing the binary in its entirety, they're almost certainly signing ever

> You can only check parts of the binary, not the whole binary Not only would they be signing the binary in its entirety, they're almost certainly signing every single byte of the update package, right down to the very last manifest file and license agreement. > some content is unpredictable once it runs Yes, but "some" content isn't allowed to run.