Your last sentence is important--what you're really asking (or assuming) is that we can "trust" the code more in signing extensions (and frankly that may not be the case). This is one of the weaknesses in the open source community. We all assume that because the code is available to all, it's "good". But what really happens (in more cases that we might want to admit) is the only "audit" the code receives is from the original developer--I'd even dare to say that most projects out on git hub probably receive very little (if any) code review prior to being released.