The app carries the public keys and also checks the key identity, that the serial number is higher than any it accepted before, the expiry date, and that the download comes from www.syncnow.it; if anything fails, nothing is installed.
New versions normally reach installations in stages: designated canary installations, then a second workstation, then a share of installations, and only then everyone. The server moves to the next stage only when its checks pass, including no security or write-integrity problem reported by the new version and a crash rate no worse than the previous version's. Sending a version straight to everyone is an exceptional, recorded decision that skips the canary stages but not those checks.
After installing, a new version is on probation: it must run for 10 minutes and reach the server at least once before the previous program is removed. If it crashes twice during probation, the previous version comes back automatically and the new one is held on that PC for 7 days, which Updates says. When a rollout is halted, for example because the new version reports a security problem, installations already on it receive a signed rollback to the previous version.