Signing is meant only to verify the identity of the organization producing the signed artifact.

It’s not meant to signify that it’s bug-free.