All of gog's offline installers are signed and do a hash check on any external .bin files they ship with.

The impact they've had on bundled malware in pirated copies of their games can not be overstated.