The worst part is that a malicious signed binary could just download the malicious parts afterwards. Signing isn't really an answer for google.