Signed by a central server. Not by the actual authors. One stolen Github account or one compromised build server and the whole thing comes crashing down. Matur

Signed by a central server. Not by the actual authors. One stolen Github account or one compromised build server and the whole thing comes crashing down. Mature operating systems that have supply chain risks in their threat model like Debian, Arch, or FreeBSD, each author or maintainer signs every contribution which are verified end to end. Even a compromised Github or cloud provider employee can easily disrupt supply chains structured this way. In recent distributions like Nix and Alpine, contributors complained that generating a PGP key is too hard, so they just decided to yolo it as though NPM security was something to aspire to. Even proprietary operating systems like MacOS require code signing. Not mandating this is crazy. IMO anyone unwilling to learn how to maintain a personal identity key of some kind has no business maintaining packages for widely used operating system.