So this works fine for users who care about gpg verification, but fails the “Windows doesn’t prompt me about insecure stuff” test.