microsoft.com or debian.org would cost a lot more than $1 and I would trust signed or unsigned software downloaded from either a lot more than from a random dom

microsoft.com or debian.org would cost a lot more than $1 and I would trust signed or unsigned software downloaded from either a lot more than from a random domain name. Code-signing definitely adds the benefit of offline key management; there is less risk of signing keys being stolen than TLS keys. But the valuation of trust is rooted in the domain; if Debian has to revoke all their keys for some reason I'll trust debian.org over any other source for re-establishing a root of trust unless a significant fraction of the Internet and mailing lists are crying foul, and even then I would probably wait for control of debian.org to be settled before trusting any Debian repositories. I still think that demonstrated control of a domain is sufficient for verifying a code-signing identity, even automatically like LetsEncrypt does for TLS.