Whether code is crap is a completely separate question from where it was invented. Putting signatures onto the individual package files could expose users to m

Whether code is crap is a completely separate question from where it was invented. Putting signatures onto the individual package files could expose users to mismatch attacks, and would also make it harder to defend against build-trojan theft of signing keys.