Comment by _wldu

It seems that all of these should be cryptographically signed by a developer's private key before publication and then verified by others before use. Is that not the case?