I surmise that this mostly impacts non-free platforms, where compiling software from source used to be quite non-trivial so it was common to just download binaries. These days you can probably get LLVM to work everywhere, though.
A few years back at my work we were digitally sign our binaries, so I don't think non free platforms are affected at all since it is not expensive to buy a certificate , only hobby/personal projects will be affected.
Also a signed binary does not mean there are no viruses or other bad things inside, so I am wondering if we want to identify the source of the binary can we find a technical solution so you can have your website and binary with the same key then you know that binary X is from X.com people, for some reason a few years back this certificates for signing were not cheap.
It's not "waste" if it's needed to establish trust.
> A few years back at my work we were digitally sign our binaries,
Just publishing hashes for the (reproducible) unsigned binaries over a secure channel (such as HTTPS as verified by Let's Encrypt) will give you the exact same security. Digital signatures embedded in executables add no security whatsoever, and make reproducibility harder. Just don't do it.
We had to sign our applications to prevent scary warnings to appear and then we would have to train our users to ignore that.