It depends what the threat model is. My understanding of Electron apps is that the binary part of the app (Chromium, node, whatever are the parts of the Electron that present the app to the user) is not changing all that often, while web app bits can be updated by simply downloading new version from the publisher's site (correct me if I'm off base here). If this is the case, then the threat here would be the attacker MITM'ing communications between the user and publisher's site and serving malicious payload to the user. Electron validating the signature before serving downloaded bits would mitigate the threat even without OS support (remember - Electron haven't changed, only web app bits have).

Note that I'm saying "Electron validating the signature" - not web app doing that, which I assume what you meant by "hand-rolling".