I would consider verifying a signature with gpg, openssl or openssh a far more important feature for code signing than adding (equivalences of) ~transport features like OLM's ratcheting or perfect forward secrecy.
If the only way to verify a package is to run code written by the same person who wrote the signing that's pretty bad.
If the only way to verify a package is to run code written by the same person who wrote the signing that's pretty bad.