Security Q:A new app fails signature verification. What steps are appropriate to address this? I downloaded an app, and after installation, it fails signature verification:

codesign -vv Amazon\ Music.app
Amazon Music.app: a sealed resource is missing or invalid
file added: /Applications/Amazon Music.app/Contents/Frameworks/update.ini


What I've tried:
I don't think it's a transmission error; aside from any internal checks, I downloaded the .dmg twice, over https (URL), and got the same crc32 both times: 74ecf8ab

The installer checks out fine:

codesign -vv */Am*er.app/
Amazon Music/Amazon Music Installer.app/: valid on disk
Amazon Music/Amazon Music Installer.app/: satisfies its Designated Requirement


Adding 

   -R='anchor apple generic'


doesn't help.

Anyone come across this before?
w/o guidance, my plan is: 


report it as a security issue to security@ (per
https://www.amazon.com/gp/help/customer/display.html?nodeId=201909140),
try to get codesign to show me what's missing,  
Pick apart the .ini