Earlier quoted context omitted.
> packaging and publishing debs is often going to be a lot more work Creating a baseline .deb file takes at most 10 minutes if you know what you're doing. To know what you're doing, you need to spend ~2 hours once. It's not rocket science (finding the documentation is tbh). :)
What about rpm? And then signing it? What's the benefit here?
When you set your CI/CD pipeline, creating packages, signing them and updating your repositories are all trivial tasks (been there, done that).
In this case, explicitly telling "this is my repository and this is the public key. gnupg the key, add this repository line, and get the packages" provides an end to end verified package pipeline. No .sh scripts to compromise.
If you keep your private keys on a network detached place and only plug your keys while signing stuff, things are pretty secure out of the box.