In reply to Josh.

Because, as Matts response states, there are a lot of more important security issues that could be tackled first. Update signing would be a big change to implement yet, right now, it offers only a minor benefit in terms of security.