First PR for#47.

To test the later components, we need a release build and a preview build signed with this key. So, this needs to be merged first.

I've tested the release script with a dry-run, and validated the pkg passessparkle/sign_update --verify, and that the app still works in a VM (specifically checking that signing it didn't invalidate the notarization, but I don't think signing it modifies it's contents, it just checks the signature matches the embedded public key)