Yeah, that's the way I would think they could do it if they chose -- sign all of the releases of the current major version and the last release of each previous

Yeah, that's the way I would think they could do it if they chose -- sign all of the releases of the current major version and the last release of each previous major version, going back, say, five years. I don't really see a compelling business case for not doing that, unless the worry is that they'd be on the hook for security flaws in old, no longer maintained releases -- which I imagine could be legally covered by a prominent disclaimer, e.g., "Releases older than [X] are no longer supported and audited for security fixes and you assume all responsibility for installing them."