Updaters are probably the scariest thing I've written. It's like sending a space probe to another planet with the risk of losing it out there with no recourse, not to mention the security implications and inherent responsibility of effectively having access to tons of users machines. FYI a Raspberry Pi makes a great air gapped machine for signing such things.
Thanks for the link! I knew something was wrong when days went by and there were no updates...