Once we have the technology to convincingly create imposters at Defcon for pennies at scale, your analogy will matter. Until then, it's irrelevant because we don't have a reason to suspect a motivated party has the means and opportunity to create that convincing imposter.

And we don’t have the ability to steal private signing keys for pennies at scale.

How is that physically impossible? You can grab the neckflap and take off the mask.

Sure, and it’s physically possible for me to hunt you down and make sure you actually used your private key to sign a document.

I mean, this is seriously moving the goalpost, but let's play along.

I tear off the Scooby-Doo mask, and the person is now exposed as being a different person.

You hunt me down (somehow? magically? nothing in PK infrastructure allows this, but let's say you do it) and I say "yes, that's my PK, and yes, I signed that" but how can you then verify I didn't take it from chatGPT and sign it?