If you are running a project like Tor Browser, that needs the highest security going, you would want:
1. Signing with an offline key, so an attacker can't make a release just by hacking the web server, and the key doesn't end up on however many hundred CDN web servers around the world.
2. Clear boundaries between releases, and a slow enough release schedule that third-party auditors can keep up.
3. Non-repudiation, so users know everyone else saw the same version they saw.
4. Reproducible builds from code in a public repo, so third-party auditors know what was released is what they reviewed.
5. An update process that verifies 1-3 before applying an update.
These requirements are fundamentally incompatible with webapps - where a no-questions-asked software update is only a press of F5 away, by design.