The fact that it is FOSS makes it _easier_ for someone to compile it with a backdoor or trojan. I would say the need for a certificate is _higher_ there. You don’t need to trust the developers, you need to be able to trust the people who have built the executable.