What is the current behaviour and why should it be changed?

Currently, only release builds are signed via @emlynmac. Now that we provide M1 builds (#2357), it would be interesting to sign non-release builds as well, as M1 Macs refuse to run unsigned binaries by default.

Describe possible approaches

It should be sufficient to use a self-signed key for that.

• Key generation (turned out to be unneeded)
• Build logic changes

Has this feature been discussed and generally agreed?

See #2357