According to https://news.ycombinator.com/item?id=19824520 https://news.ycombinator.com/item?id=19824520 the signatures are on the extensions themselves, not on

According to https://news.ycombinator.com/item?id=19824520 https://news.ycombinator.com/item?id=19824520 the signatures are on the extensions themselves, not on a remote server.