ghcup mac binaries should be signed

On macos monterrey (12.2.1) on m1, at least, the ghcup v0.1.17.5 binary installed by ghcup upgrade didn't run because of an invalid signature (probably disrupted by stripping). This has now been worked around by not stripping them. But such unsigned binaries are probably (can't recheck on my system) hard to run because of giving the "could not check for malicious software" warning, which must be bypassed eg in System Preferences > Security & Privacy for each new ghcup version. codesign -s - BINARY seems to be a way to fix stripped binaries, adding an adhoc signature and bypassing the warning. But ideally these binaries should be signed with an official Apple developer ID, to prove they are genuine. A Haskell Foundation developer ID or similar might be ideal.