Workflow bundles lack publisher signatures

The published bundle format is hashed and reviewable but lacks an application-level publisher signature. The developers list a signing layer as missing (S-1505).