PKI signatures aren't (legally) necessary, just a binding statement that what they are presenting to you is a certain version of the contract and hasn't been mo

PKI signatures aren't (legally) necessary, just a binding statement that what they are presenting to you is a certain version of the contract and hasn't been modified. Lying and modifying it would then be a serious misrepresentation that I don't think they could get away with. I think the idea is similar to OSI certified licenses. You only have to read (for example) the LGPLv3 license a single time regardless of how many of your dependencies use it.