Signed commits help only if CI or users check them. At that point pile on more GPG stickers and wait for the next supply chain headline to remind people that npm treats signature checking like optional decor in practive.