Sparkle 2 can be used with sandboxed apps. It seems just about ready to be released. Consider adding automatic updates and figure out if that can be done with a relatively low amount of overhead in terms of update hosting, etc.