Alright. This sounds like something we should be eventually doing. Not sure if we should prioritize it right now. GPG-signing the binaries for extra verifiability is another thing we could do in the meantime, though it doesn't fix the OSX issue.