Hate to tell ya but package signing is not a new problem and they could make it opt-in. There has been a Github issue and merge request submitted to enable it. But they were closed and denied. Malice or incompetence?

Hilarious that you think this is a some sort of impossible feat for a trillion dollar company.