I think Debian tried to do an "only include signed packages" thing but failed because it's a massive undertaking.