Comment by AJRF

That reason being digital signatures. You can get the same confidence from posting an MD5 hash to check. Xips are an awful solution to fix a solved problem.