Would there benefit in optionally verifying the hash or signature of the rcodesign binary?

- Would there benefit in optionally verifying the hash or signature of the rcodesign binary? Right now there is no such check:
https://github.com/indygreg/apple-code-sign-action/blob/main/src/main.js#L51. I'm not sure if you sign the binaries right now or if you'd be willing to though.

- And if you think there would be benefit, would you take a pull request for to implement this optional feature?

Thanks!

Start at the rcodesign binary handling in src/main.js around line 51. Determine whether the distributed binaries have a verifiable signature or hash and clarify the optional verification inputs and failure behavior. Done requires an agreed verification design and coverage for enabled and disabled verification.

Written by the indexing model from the issue text.