We could, but those keys can be stolen as well. As long as the signing is, for example, done through an automated CI/CD, the keys would only work as a second st

We could, but those keys can be stolen as well. As long as the signing is, for example, done through an automated CI/CD, the keys would only work as a second stronger password. What might work would be an interactive two factor authentication similar to how Microsoft or Google does it. Every time a release to the package repository was awaiting, the author would get push notification to their primary device and it would have to be approved manually.