But it's not doing what quarantine normally does; quarantine says that the app cannot be opened because it was an unidentified developer, and you can work around that by ctrl-clicking the package and selecting "open." This was a completely different error message, about the app being damaged.
The really weird thing is that when I download it through the app vs the web and do a byte-for-byte comparison between the resulting .app bundles, though, it finds no differences.