I have received a reply from QRZ.COM. Unfortunately a bulk download of all registered callsigns is not available. They told me that I could query the XML API, but given that HamAlert processes millions of spots per day with tens of thousands of unique callsigns (at least), and each XML API call is for a single callsign only, I’m pretty sure HamAlert would get banned from the API almost immediately, even when caching the results for a while.