Comment by slipstream-

pup bundlers also tend to be signed. just checking for a valid signature would not be enough