- multisig approach: you can require multiple signers to sign a release for it to be accepted by downloaders. Protects against account compromise. Sigstore relies on OIDC, but this makes it often reliant on megacorps (and harder to self host, see next point)
- very easy to self host. You can deploy it internally without any problem, eg in an airgapped environment where you want to distribute signed artifact. This is impossible with Sigstore.
- accountless: the key is the identity. The multisig approach diminishes the problems that long-lived keys might bring. And you don't rely on an external OIDC provider to be able to sign.
- Air-gapped signers: it is possible to have air-gapped signers, as signing does not rely on an online service to verify an identity.
- easy for downloader: the use only has to provide the download url, and this is sufficient to authenticate the download.
- easy to audit: the backend data is stored in a git, that will be mirrored in different places, and anyone can mirror it for themselves.
You might agree or not with these choices, but there are enough differences to say that it doesn't reinvent the wheel, it's providing another approach which I think has its advantages.