I should make a `sigpipe` tool that checks a signed checksum. The sig likley wont be carried in the executable, but the hash is enough: ``` sigpipe <hash + sig> <untrusted >trusted ``` need PKI though