That's actually a good point - tons of IoT is "secure enough" to sign things, but not secure enough to bother pinning anything ...

Also who hasn't left their private keys hanging around web-accessible, eh? lol