Public releases are published by Binair. Worre verifies the signed manifest and package checksum before installing updates.
Signed update manifest
Visit Worre