Uploading to package managers (or convincing said managers to package your upstream, this is a particularly big problem for fragmented OSes like Linux desktops) also don't scale easily from the developer's side compared to configuring TLS which is usually a single toggle on your cloud host's DNS config.

If I had to chose between developer signed packages and TLS, I'd go with signed packages, because at least then I know I get what the developer intended to give me, no questions asked. TLS guarantees security in transport, yes that's true, but a package signed by the developer guarantees that even if the mirror itself been compromised and still has a valid TLS connection, my system won't install a rogue dependency.

Luckily in our real world, we can have both of them, and that's of course best :)