I don't have any comments to add at this time. For our macOS installers, we currently depend on Apple's macOS notarization service to catch code-signing and similar issues. Every macOS installer package that we release has to go through the notarization process to be able to be readily installed by downstream users. They would have to go out of their way and jump through hoops to override the operating system's defaults to be able to install software via a macOS installer package that does not pass the system Gatekeeper checks including a valid notarization ticket. I've made a note to look at adding something here about macOS and how to handle revocations at some point.

@ezio-melotti @hugovk Happy to go back and wrap lines in a separate PR after this is merged if that's appropriate 👍