Since when would a signed binary help when your "opsec" says it's the software itself that is compromised?

Software can still be compromised if it is compromised before being signed.

Assuming you somehow trust the source code and not the binary, in fact, you're better off compiling it yourself and checking if the non-signed software you get is similar enough to the binary you can get from others - Assuming of course you can actually reach reliable reproducible builds with a Windows build chain, a thing that last time I checked was horrible and flaky.