When you set your CI/CD pipeline, creating packages, signing them and updating your repositories are all trivial tasks (been there, done that).

In this case, explicitly telling "this is my repository and this is the public key. gnupg the key, add this repository line, and get the packages" provides an end to end verified package pipeline. No .sh scripts to compromise.

If you keep your private keys on a network detached place and only plug your keys while signing stuff, things are pretty secure out of the box.

RPM is much simpler than deb: .spec is just single file with metadata, build recipe, and list of files. Example:

https://src.fedoraproject.org/rpms/5minute/blob/rawhide/f/5m...

Signing of packages is used to protect from malware.