This depends on your Linux distro. The package maintainer has to set a build flag to allow disabling the signature requirement. This should be set on Debian, and probably distros downstream from Debian, but was not set on Arch Linux last I checked.

Huh, never knew that. I wonder if that's because it's harder for Android apps to edit the settings of other Android apps (unless they have root access, but that's much more rare on Android than, say, Windows or Linux or macOS)?

Mozilla's official Linux builds disallow xpinstall.signature.required = false (last I checked), but the unbranded builds (as well as builds provided by at least some repos) do indeed allow signature bypassing.

This is the first I heard of that solution, and we're what, 5 or 6 days from the issue? I read a number of Reddit posts and the Mozilla blog post and I don't recall seeing this mentioned.

Edit: on second thought, maybe I saw this solution (with or without the mention of nightly) and skipped over it as the Mozilla blog post on May 4th said "There are a number of work-arounds being discussed in the community. These are not recommended as they may conflict with fixes we are deploying."