They can't. But they can't tell for sure if large tech corporations are doing that either. Data breaches are a thing. Auditing Github workflows doesn't prevent them.
replyMicrosoft can't even figure out how to send email reliably. But sure everyone should trust them with signing packages.
reply