It also gives a false sense of security. There have been supply chain attacks in the past that succeeded because the attackers got their hands on a cert and sig

It also gives a false sense of security. There have been supply chain attacks in the past that succeeded because the attackers got their hands on a cert and signed malicious code.