How would that solve anything? If an adversary has the ability to push an update then it is game over regardless on if it is signed or unsigned because most don’t check existing keys prior to updating.
Once an adversary has gotten so deep in to your infrastructure that they can push an update the signing keys are mostly irrelevant since chances are they have those already.
If you are asking if each individual contributor should sign/publish their signatures for each update then yes, perhaps. But then which takes precedence - The org or the contributor? Which should/would you trust more and why? And can that prior trust be worth anything if/when either the org or the contributor goes rogue, is compromised, decides to push an obnoxious update or is rubber-hosed in to compliance?
F.W.I.W. the approach I take is to let others be the Alpha/Beta testers for any update and check out the various channels for abnormal reports. For High Severity issues I take a look at the mitigations sections and adopt those in a 'wait and see' approach.
I can imagine edge cases for both which leads to my conclusion that doing so is meritless unless you are considering nation state actors pushing an update but that then leads to the edge case of which update do you trust? And why do you trust that as the ground truth of good/not good?
