Unpacking the distribution package like the autopkg recipe (somewhat intuitively) breaks the pkg signing, adding distribution overhead when e.g. only a single component has been updated or orgs are rebranding the Managed Software Center app.
Offering signed pkgs for each component would just be a nice-to-have, the signed/notarized contained executables are way more important, but I would use e.g. the python flavor if available
Unpacking the distribution package like the autopkg recipe (somewhat intuitively) breaks the pkg signing, adding distribution overhead when e.g. only a single component has been updated or orgs are rebranding the Managed Software Center app.
Offering signed pkgs for each component would just be a nice-to-have, the signed/notarized contained executables are way more important, but I would use e.g. the python flavor if available