Handbrake is a very popular package. It's probably downloaded about a million times a year. It would be very easy for the author to pay for a code-signing certificate with either donations from users or unobtrusive, inoffensive amounts of advertising.

Best practices call for releases of executable code to be signed for the reasons outlined here.

Small enough?