SSL certificate signing provides basically the same level of trust as a signed installer. As long as you curl over https from the domain you trust, you're good.
EV signed software is usually done off the internet. In our case we use a physical key to sign it offline and then upload.