My specific point was made in context of maven central repository.

It gives a false sense of security when you have to have a signed pgp key but no challange for trust.