Some systems require things being signed, but don't care for who signed it.
E.g. the open source pro bono Maven/Java library repository.
I think it serves the purpose of ensuring integrity with no requirement for revamping revealing the identity.
I think it serves the purpose of ensuring integrity with no requirement for revamping revealing the identity.
One thing it can be used for is continuity of authorship, though, I suppose: “v2 is by the same pseudonymous person that published v1”.
> "Whoever holds the same key that signed this package"
This only matters if you care or know what the keys are. If your guards let anyone in with a blue pass, it doesn't matter what the name is on the pass or if it even matches the name of the person.
> 'this whole charade is pointless ... but it does solve this somewhat tangentially related problem ... kinda'.
I'd assume it isn't – why else would they be doing it (other than for compatibility with some package distribution scheme that, for other use cases, enforces the existence of a signature, which is arguably just a special case of "you don't need a signature scheme").
Attackers could generate a key and sign a hacked artifact. Yes, somebody signed that artifact you might say, but I would worry who signed it and how much I should trust them.