1. You are using MD5 hashes which are trivial to create collisions of 2. None of your artifacts or build script are signed by you (third party signs by apple a

1. You are using MD5 hashes which are trivial to create collisions of 2. None of your artifacts or build script are signed by you (third party signs by apple are pointless) 3. Builds have no evidence of being reproducible, or anyone having reproduced and counter signed them. Compare to say the Bitcoin or Monero processes that have multiple people build and sign every release so it is easy to trust there were no SPOFs.