Comment by flatiron

I know PGP isn't perfect but why aren't packages signed by their maintainers?