[shittyadmin]

You're still getting a signature directly from the developer's machine, not from the repository server and as such you're still vastly shrinking the attack surface.