How do you enforce it?

Cargo (rust) considered it, using the vastly more information it has about whether signatures have changed than NPM, but rejected it because you can still make breaking changes without changing a function signature, so why claim to detect it if only a subset can be.