What should the punishment for Arch, Debian and Fedora be, then? Not only are unsigned binaries normal there, but as far as I know, the infrastructure doesn't even exist to check the signature of a binary on execution.

I mean Debian and Fedora (not an arch user) sign their packages with GPG. It's a higher level up but effectively the same thing.

A runtime signature check is far more secure than an install-time signature check. On Linux you can swap a binary with an evil version using one of a million local privilege escalations available and nobody would ever know unless you have additional tripwire-style tooling set up.

The repositories support signing so binaries that are sourced from these repositories are verified by the associated signatures during installation. If you trust the installation, would you include the execution in that same trust? Windows does not include signed repositories (or any that I know of) by default. (I could be wrong about that but if it does exist, the software collection is nowhere as vast as the distro repositories.)

1. Debian - SecureApt - https://wiki.debian.org/SecureApt

2. Arch - pacman/Package signing - https://wiki.archlinux.org/title/Pacman/Package_signing

3. Fedora - RPM - Checking Package Signatures - https://docs.fedoraproject.org/en-US/fedora/latest/system-ad...

Windows does not generally have the concept of a 'repository' (WinGet excluded, but that's fairly new). The Microsoft Store is the closest thing to a repo, and those are signed.

Everything coming from Windows Update is also signed by a public CA.

None, but the reasons are more legal than technical.

None of those projects have come close to Microsoft in terms of creating a product, for pay, that average people reasonably rely on.

Again, using a legal definition of reasonably; a widely used and paid for product can be held to something like a "merchantability" standard - especially if Microsoft has ever claimed their product to be safe and secure, which I'm fairly certain they have.