They didn't get it that right (as the other dude said - it's server side security by the service provider).

Requiring that third party dependencies be signed should have been the default in Maven itself.