With the public key you can use code-signing to verify that your code hasn't been tampered with. That's the whole point. It's not about man-in-the-middle, it's about ongoing integrity. If someone gets into a server, if you have signed code, you can easily tell if that code has been changed without going back to the server. Because you have the public key.

So you could download code on Monday and the source server could be hacked on Tuesday. If you check against the source server you're vulnerable. If you check the signature only, you're not.

I think Matt has wilfully dodged that whole point of it, though it's fair that the original argument didn't specifically prime people on the whole purpose of code signing either.