My point is that they support unsigned packages.

It’s not possible to download a package on apt without signatures, by default. All packages are signed.

We tell people to use Signal, not Telegram, because the later allows unencrypted messaged by default.

I don’t know of any common oci repos that have many signed packages. If you make it your policy to require signatures, there’s almost no images you’ll be able to download because almost none are signed.

Whereas it’s 100% of packages in Debian’s apt that are signed.