Does it makes sense to sign the zip, eg:

https://gist.github.com/rchavik/5209981#file-release-croogo-sh-L163-L170