Comment by lrvick

Package signing of any kind was ruled out in 2013 for nonsensical reasons https://github.com/npm/npm/pull/4016