Just mentioning because you explicitly said builds are unsigned: I'm working on a (open source) signing solution supporting GitHub releases that is easy to use for both signers and downloaders. Let me know if this would interest you (not immediately putting link to avoid spamming).