That could presumably be solved by allowing developers to sign their own add-ons and tying the ID to the key they used to sign it - it doesn't require a centralised signing system of the kind Mozilla introduced.