It goes further than that. Knowing that leftpad 1.0 was indeed signed by johndoe1234, author of leftpad, does not help you in trusting that leftpad actually lef

It goes further than that. Knowing that leftpad 1.0 was indeed signed by johndoe1234, author of leftpad, does not help you in trusting that leftpad actually left pad strings correctly, that it doesn't do anything malicious, that vulnerabilities get patched, etc. In other words, it does nothing at all for you. Sure, you might trust Facebook, and so knowing that React 18.0 was indeed signed by Facebook is interesting. But then React depends on leftpad, is-odd, reversearray, ... by random devs. What security do you gain by verifying the random signatures from random devs? Unless there is a way for Facebook to sign those transitive dependencies, vouching for them in a way that you can check. That would be something. But their authors signing them does nothing.