tl;dr Project aurora was a series of attacks in 2010&#x2F;11 where Chinese attacked the SCM of major companies.  Juniper <i>may</i> have had its SCM polluted without going through normal review processes<p>And so signing code patches looks like a good idea.