Probably better to just do update signing, certificates rotate frequently and at some point you’re bound to run into an enterprise customer with a MITM / caching proxy.