(my knowledge is circa early 2000s) Debian has (had?) a high barrier to entry to become a developer, and every developer signs their packages. The release bina

(my knowledge is circa early 2000s) Debian has (had?) a high barrier to entry to become a developer, and every developer signs their packages. The release binaries are arranged on a secured box and the release key itself is held by a limited set of people. In short, the signatures work because of the human element and organizational structure of Debian. Rubygems accepts submissions from the general public. So, again, I don't see how it would have helped.