But maybe some other part of the toolchain (Gradle, GraalVM native-image) was implicitly ad-hoc signing it