Why such stuff isn't signed, like packages in every serious Linux distribution since decades?