@briankrebs You can mount the .dmg on macOS and use a combination of codesign and spctl on Signal.app in the terminal to verify that it comes signed with an Apple DeveloperID and that the contents haven't been modified after signing. But that's as far as I got.