> As a Debian user, I'd like to draw a parallel between these measures and the default requirement for GPG signatures on packages installed by apt

Said parallel is imperfect. With APT, you can add custom signatures (say, if you run a private or organization-specific repo). AFAICT, Firefox offers no such capability.