> You're going to tell me "you check against a digital signature". Except it doesn't work. You can only check parts of the binary, not the whole binary (as some content is unpredictable once it runs).

I read this a few times, and I still don't get why you wouldn't check the whole binary. Care to elaborate?