Apple's code signing actually has this and it's on by default. Don't ask me why it didn't help with their installers, though..