> Curl checks the https certificate.

Which is not the same thing as a signature on the package, is it?

> Distro maintainers in general do not audit the code they package.

First, it depends on the distro. Second, they certainly do at least some kind of due diligence before packaging a new project. So there is some amount of selection (which you don't find in npm, cargo or pypi).