I just checked my Steam library and none of them use codesigning so I guess that solves that. Video playing apps do though, so depends on plausible deniability.
It does seem like this could be fixed using the private relay system. It certainly doesn't need to be unencrypted.
