so it’s based on people following an npub of an account associated with the download? does it require the binary is signed by the corresponding nsec?

would be nice if there were a stronger endorsement scheme representing something like “i’ve downloaded and endorse this binary”