Agreed. Cryptographic signing of extensions in this context doesn't seem to me to be significantly different from the signing done by your other package management systems.
One of my professors said "the browser is the new OS" about a decade ago. This seems like more proof of that to me — if we want fast, low power JavaScript in browsers, we have to have a reasonable chain of trust imo.
One of my professors said "the browser is the new OS" about a decade ago. This seems like more proof of that to me — if we want fast, low power JavaScript in browsers, we have to have a reasonable chain of trust imo.