Not sure about that exact scenario, but a digital signature scheme without a set of trusted keys/signers seems pretty useless: If it's about e.g. detecting tampering of large files, a hash function achieves the same result much more efficiently.
One thing it can be used for is continuity of authorship, though, I suppose: “v2 is by the same pseudonymous person that published v1”.
That's not the same as "not caring for who signed something" though, if you think about it: "Whoever holds the same key that signed this package" is still an identity, if a pseudonymous one.
But if you don't care who signed it, then you won't even notice if it was/wasn't signed by the same key. That's what I got out of what they were saying. As in, 'this whole charade is pointless ... but it does solve this somewhat tangentially related problem ... kinda'.
> "Whoever holds the same key that signed this package"
This only matters if you care or know what the keys are. If your guards let anyone in with a blue pass, it doesn't matter what the name is on the pass or if it even matches the name of the person.
If nobody cares at all who signed a message, you don't need a signature scheme.
> 'this whole charade is pointless ... but it does solve this somewhat tangentially related problem ... kinda'.
I'd assume it isn't – why else would they be doing it (other than for compatibility with some package distribution scheme that, for other use cases, enforces the existence of a signature, which is arguably just a special case of "you don't need a signature scheme").
One thing it can be used for is continuity of authorship, though, I suppose: “v2 is by the same pseudonymous person that published v1”.