Maybe I just don't understand, so could you explain to me how gpg signatures actually fix this problem? Would they fix this problem for npm? I'm asking about t

Maybe I just don't understand, so could you explain to me how gpg signatures actually fix this problem? Would they fix this problem for npm? I'm asking about the specific attack detailed in the tweet.