I think we have completely unrelated threat models. I'm worried about malicious USB ports / devices trying to steal my data or at least make me have a bad day. If someone is trying to set a device on fire, authentication won't help. They just need to fail authentication and use that as the bomb's trigger.

You're worried, I think, about poor-quality devices that aren't malicious, just incompetent - or poor-quality cables. (I'm already willing to carry my own cable - I already carry a USB-A data blocker around, but USB-C data blockers don't seem to exist.) I think that can be solved without cryptographic authentication, with the standard approach of having a certification organization like UL or the USB-IF themselves investigate cable/charger production and test them. It seems the major problem here is with Amazon listing cables without showing whether they have certifications (or checking whether certifications are forged), and that's a general Amazon problem with poor-quality hardware and counterfeits.

This article is talking about autorun, Stuxnet, etc. so I think they're focusing on the latter. If the USB-IF wanted to use digital signatures to authenticate cables I'd be more on board, but if they do that, they should just be authenticating cables, not devices. (A cable, I believe, can be engineered to just cut the circuits if a device tries to pass too much voltage, or is wired backwards, or something.)