All Binaries in Portmaster are signed, we either use an official EV signature or self sign binaries.
The Windows installer, kext and start are signed with EV signing keys.
This process makes sure that you only install official Safing updates and at the same time that the download was not corrupted before starting the update.
Open a Terminal and enter:
/opt/safing/portmaster/portmaster-start verify
The output should look like this: