> Why is it reasonable to assume that? I don't think it is, at all. If their SSL certs are comprised, all bets are off.

I have no statistics to offer, but it does seem likely to me that TLS private keys gets compromised more frequently than software/package signing keys.