2 ms·

The repository doesn't have any access to the developer's private key. That's exactly the attack that they're designed to mitigate.