When developers sign their content packs, they will do so with a certificate which has typically been signed by their certificate authority. However, when Client Certificates are used for authentication of RAS servers, for example, these certificates will, naturally, be signed by the same authority.
This causes customers an issue, since anyone who has a valid certificate can then sign a content pack and it will pass validation. To try to get round this, customers could use a separate certificate authority but, since the truststore will have both sets of root and intermediary certificates, this would be pointless, meaning that anyone, as long as they have a valid certificate, could sign content and the pack would pass validation on import.
We need a separate mechanism to authenticate and authorise content signed by a limited number of people, not just anyone in the same organisation.