We have tests in flutter/dev that verify that artifacts downloaded (via flutter precache) are code-signed:

This does work, but as a result of FLUTTER_PREBUILT_ENGINE_VERSION overrides (see https://github.com/flutter/flutter/blob/main/docs/tool/Engine-artifacts.md#flutter-cicd-testing), this test will test the artifacts built at the current commit, not the artifacts that are actually downloaded by user-builds - those would normally be dictated by engine.version.

This decision was originally made because:

1. (Minor) New branches (without an engine.version) would fail all post-submits
2. (Major) Branches where an engine CP landed would silently use an older engine(.version) until updated

Now that we have checks in place that engine.version cannot be stale, we can revert this Cocoon change - (1) will be impacted, but we'd never publish in that state, and (2) is at least guarded by the fact that engine.version has to be updated, and we can do one last clean post-submit run.