I’m not one to chase the new and shiny, but how do you know a nominally months-old software package isn’t a newly compromised version at the time you download it?
Digital signing on Windows predates Mac developer certificates by years but arguably wasn't widely used outside of security-paranoid organizations.
Before someone says Linux offers GPG signing it's mostly useless without a central PKI. Developers offer the public key for download on the same server as the software. If someone uploaded compromised software, surely they would replace the key with their own.
...or, much more likely, any potential benefits are not worth the negatives.
I don't know how easy/hard it would be to compromise that.
One could also argue that GPG signing is useful exactly because it doesn't rely on a central PKI.