Artifacts in the central repository are also signed, it's a requirement: https://docs.sonatype.org/display/Repository/Sonatype+OSS+Maven+Repository+Usage+Guide

Artifacts in the central repository are also signed, it's a requirement: https://docs.sonatype.org/display/Repository/Sonatype+OSS+Maven+Repository+Usage+Guide#SonatypeOSSMavenRepositoryUsageGuide-6.CentralSyncRequirement https://docs.sonatype.org/display/Repository/Sonatype+OSS+Ma... Checking the actual signatures is another story ;).