> Signatures for OS or package updates

> lack state or any notion of a keyring

And thus being completely useless for the purpose. This is quite a fundamental misunderstanding of the use case.