How is this much different than how a deb or something gets installed? Actually, Windows installers are expected to be signed by default and it'll warn you if they aren't.