The .pkg is signed, otherwise it won't run (unless you have disabled that feature, in which case you are driving around without seatbelts anyway)