[throwaway4891a]

I'm not using 1.0.0+ until it's codesigned and/or dmg gpg verifiable with a known-good signature.

Do not install untrusted, unverifiable apps is security 101.

[nradov]

Just download the source code, audit it, and built it yourself.

[jonnytran]

Who has the time to audit the source code of all the code they'd like to run on their computer? If you find them, I'd pay them to audit it for me, build it, and sign it so that I don't have to.