In which case what's stopping the malicious software from replacing the official build with the sign-disabled version?

There is no way of doing this that both respects users freedoms and prevents malicious software.