The update package itself is signed.