Are the MailMergic Offline app downloads code-signed, and how are updates secured?

Yes. The downloads are code-signed on both platforms:

• Windows builds are Authenticode code-signed through Azure Trusted Signing. Every executable and library, plus the updater, is SHA256 signed and timestamped.
• macOS builds are signed with an Apple Developer ID certificate.

Updates are delivered over HTTPS through the built-in auto-updater. Their integrity rests on the HTTPS transport together with the platform code signatures.