Additional security - validate signature of TrueUpdate.exe?

We have begun adding additional security to our auto update routine. One area we see as a hole we are trying to fix is if the server was compromised and they replaced our exe and dat with their own. You can see this being a downside to updating itself. With all the documentation for TrueUpdate, I only see a way to detect after the update has already occurred. There is text indicating something within the ts1 indicates an update is necessary, but that is probably not something IndigoRose wants to release. Is there another way to detect a pending update to the exe/dat files? Thanks