The whole software signing certificate industry is broken and won't save anyone from hackers. What's the point of certificate when "verification" is just bureau

The whole software signing certificate industry is broken and won't save anyone from hackers. What's the point of certificate when "verification" is just bureaucratic process which does not verify anything, especially if you are not from anglophone country. How does certificate provider want to verify that company in Eastern Europe exists? By some scanned piece of paper which they don't understand because it is written in language they never heard of and robocall which is just sequence of numbers? If you want a certificate for signing, you will get it.