> until it becomes a signed binary

It's already a signed binary, with rollback protection. (According to Reddit comments; I stopped using Raspis a long time ago)