I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?
Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations.
Before someone says Linux offers GPG signing it's mostly useless without a central PKI. Developers offer the public key for download on the same server as the software. If someone uploaded compromised software, surely they would replace the key with their own.
I don't know how easy/hard it would be to compromise that.
One could also argue that GPG signing is useful exactly because it doesn't rely on a central PKI.
...or, much more likely, any potential benefits are not worth the negatives.