Packages are signed in exactly the same way Debian packages are signed, ie the package files themselves are not signed but the index file that lists them is.