But I know for at least gem and npm, while they support signing, they are not used in practice. And those two repositories are used by a large number of people

But I know for at least gem and npm, while they support signing, they are not used in practice. And those two repositories are used by a large number of people browsing this site.