The hashes for the mac release don't match.
Yes you are right. Due to a typo, I was re-generating the GPG message and unintentionally re-created the dmg file, which unfortunately I didn't upload to Github along with a new GPG message. A regenerated Mac dmg file, even from the same input files, gives a different binary output, hence a different hash.
Just a moment ago I have uploaded a mac dmg file with a hash matching the signature, i.e.: 4e511269e9416515d6ebcbc9fa8b51a377f9f51b76d65252fd604614b0a76525e3de8cd4e4401ecd8af389ab5cdb4954580ccf9fb2ad064c4df5fdc14e2c0d40.
Thanks for letting me know and sorry for the confusion.