TLDR version: SSL/TLS does not verify content. Maven central allows users to upload content, so you can obviously not link a certificate with that content. Mav

TLDR version: SSL/TLS does not verify content. Maven central allows users to upload content, so you can obviously not link a certificate with that content. Maven Central has users sign content with PGP keys. PGP keys are also a poor means of verifying content. Especially if you have no other channel to verify a PGP key. These are all known things, and have been for quite a while. Apparently it is news that users of Maven Central trust this this to give them a false sense of security.