Infra steps

[cpurdy]

Signing:

• We have 3 platform specific launcher executables (macOS, Windows, Linux)
• We have a Windows installer executable (.msi extension); it should be signed
• We do have a code signing certificate, but it can't be used for macOS (because Apple is special)
• The Apple certificate comes from the Apple developer program (ours is currently expired, so we'll need to re-up the org's membership and get a new one, which is easy)
• We don't want these certificates in the wild, e.g. on github (even if in their "secret store")