Chrome extensions should be signed and should prevent updates of extensions if the new version was signed by a different from the one signed the current one until the user manually approves it.

The problem is malicious actors will only buy the extension conditional on the author handing over the signing key as well.

Most users will click straight through the approval though, like when they granted it full permissions at install.

And is the signing actually effective anyway? There's very little mention of it online, and as far as I can see it isn't covered in the official guide for publishing extensions.

Is it even possible to have proper signing keys stored locally or air-gapped?

No, just straight up refuse unless the new signing key got approved by the old one. Hard-block. Why shouldn't it?

To be honest that problem exists for essentially any software that auto-updates.

You just have to hope that the built-in integrity checking (if any) works and is effective.

That's why I like software distribution methodologies that rely purely on signing to verify authenticity, rather than simply the location that it was downloaded from. I can technically use any old dodgy Apt mirror that I want, as long as I only accept packages signed by trusted keys.

As a side note, it's shocking how many software providers say that their downloads are 'integrity checked' just because they're served over HTTPS.