It would be great if the binaries on the releases page came with GPG signatures so that we could verify that the downloads haven't been manipulated in bad ways.