Sign binaries

[neil-da]

For general security reasons it would be nice to sign all binaries we produce for a release, including the installer. No need to do it immediately, but in the medium term.

CC @shaul-da

[garyverhaegen-da]

First step would be to have a secure signing key on the CI server. I'm not sure our current "secrets" infrastructure is fit for that kind of purpose, so I'd start by reviewing that.

[neil-da]

Turns out to be quite important for the installer itself, or we get Windows defender being upset.

[cocreature]

Our Windows installer is now signed. If we decide to sign other things (signing Maven artifacts is already tracked as part of the work towards publishing to Maven central), let’s open separate issues for that.