OK so I guess its now safe to recommend fetching the addon from Mozilla’s servers since they are now all signed. It will be as simple as pointing it to where the custom rules file is installed.
I wonder if TBB makes any attempt to check signatures though… I know for freedom reasons signed extension support is dropped out of the Tor fork. I may have to check that out.
All Firefox extensions - for Desktop and Android - on AMO that have passed review are now signed.