There needs to be no protection reduction from using disk spanning in apply: all information extracted with the unsigned .bin data files undergo SHA-1 verification (offered dontverifychecksum just isn't made use of). The SHA-one hashes for this (in addition to all other metadata) are held within Set up's EXE, which happens to be shielded by the dig