Oofda, ok, we're good. The MSI that was still associated with the tag looked bad. I've deleted it, and the MSI that's currently associated with the 4.9.0 tag is both signed and has signed binaries