It probably does, but what good does that do if the source code wasn't transported securely and verified from the upstream to the packager?

Disclaimer: I don't know anything about brew packaging practices. Maybe they always require verification. Maybe they don't.