Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.