[martinknafve]

Wouldn't it make more sense to sign the binary then?

[alexchantavy]

Yeah, really silly that the legitimate binary for Handbrake isn't signed. Sure, if the intruder had compromised the hosting server then they might have also compromised the signing cert, but that's still an extra step.

[marcosdumay]

Aren't both the same thing?

How else can you sign a binary?

[martinknafve]

OP was referring to creating a hash, signing the hash and publish the signed hash on the web site.

The alternative would be to sign the actual binary file using code signing (internally I assume that relies on a hash ).