They didn't get it that right (as the other dude said - it's server side security by the service provider). Requiring that third party dependencies be signed s

They didn't get it that right (as the other dude said - it's server side security by the service provider). Requiring that third party dependencies be signed should have been the default in Maven itself.