An attacker would need the private key to update the signature in the app cast. It's possible the devs store their private key on the server, although that would be silly.

Although that doesn't discount the recent MITM vulnerability Sparkle had and if transmission is still using an old version of the framework.