If I had to chose between developer signed packages and TLS, I'd go with signed packages, because at least then I know I get what the developer intended to give

If I had to chose between developer signed packages and TLS, I'd go with signed packages, because at least then I know I get what the developer intended to give me, no questions asked. TLS guarantees security in transport, yes that's true, but a package signed by the developer guarantees that even if the mirror itself been compromised and still has a valid TLS connection, my system won't install a rogue dependency. Luckily in our real world, we can have both of them, and that's of course best :)