@clacke @stman

Sorry if I was unclear, but that's exactly what I meant... They don't.

What does help is some kind of reputation measurements in the first place (likes, downloads, "verified suppliers") and only then digital signatures to prevent spoofing.