[FiloSottile]

I would love to learn more. What's the package integrity story of Java and .NET?

All I can find is documentation about artifacts on e.g. Maven Central being signed with any PGP key, which can freely change across package versions. If that's correct, it's no more than a convoluted checksum (without anything resembling the Checksum Database and its transparency log). If that's not correct, I am very curious what the workflow is when a package author loses a key.

Or, more concretely: what's stopping Maven Central from serving a fake version of someone else's package to a targeted victim?