I shiver when I think how many pieces of code are fetched over the internet on my machines. If you are a motivated attacker you can compromise a plugin author'

I shiver when I think how many pieces of code are fetched over the internet on my machines. If you are a motivated attacker you can compromise a plugin author's PC or server and silently push a backdoor to a whole lot of people. Signed releases are commonplace. It would make sense to require them in most plugin systems, especially those with central plugin repositories and lots of users.