The current uploaded packages matches the shas in the PR. They have reasonable signatures, and I’ve notarized the mac ones.