I filed a bug here:
https://bugzilla.redhat.com/show_bug.cgi?id=1714062
However since that assigns it to mbriza who doesn't do binary signing
for Windows or macOS, I'm not certain that's the correct way to report
it. Maybe websites or release engineering?