> The issue is that if you leave any sort of lever that reduces security, it will be abused by bad actors. As you can see in this discussion, there already are

> The issue is that if you leave any sort of lever that reduces security, it will be abused by bad actors. As you can see in this discussion, there already are some obtuse ways to disable/ignore the signing. It's just way worse if people have to disable the signing instead of adding a trust for their own certificate, so that only mozilla and user's addons are truste instead of all the malicious garbage out there on the web.