&gt; PS: who cares if the devs are using unsigned software downloaded over HTTP? I care about using signed software (and then I suppose the transport doesn&#x27;t really matter), but that&#x27;s totally unrelated to what the devs do on their own computers.<p>This is definitely a vector that attackers can and do use. If the developer is infected, particularly by a virus that changes the compiler to emit infected code, this can by proxy infect the products they develop.<p>See e.g.:<p><a href="https:&#x2F;&#x2F;www.ece.cmu.edu&#x2F;~ganger&#x2F;712.fall02&#x2F;papers&#x2F;p761-thompson.pdf" rel="nofollow">https:&#x2F;&#x2F;www.ece.cmu.edu&#x2F;~ganger&#x2F;712.fall02&#x2F;papers&#x2F;p761-thomp...</a>