Release builds and signing

[leoluk]

No description provided.

[lorenz]

This is also related to the bundle format, which will see metadata added with #329 and also should still be changed to something streaming-friendly (and probably use zstd instead of deflate for better compression and perf). The zip bundles were just a stopgap, they are not particularly well-suited to what we need from them. This bundle format should then also be designed from the start for signing.