This is pretty cool and i think one of the good application areas of distributed ledger technology.
Signing is still a hard problem, even for established projects like Rust. Right now, rustup does not verify signatures in any way or form. The security is solely thanks to https and the S3 bucket not being compromised.