> a self-contained, signed extension ecosystem

What does this mean? Can I easily sign my own private extensions with my own key?

We are currently allowing unsigned extensions, loading them, then locking the duckdb config to prevent loading unsigned/untrusted extensions

In 2.0 you can sign extensions with your own key and have your own extension repo. Thats the plan at least.

In 1.5 - Haybarn has its own signing key, but its much faster to get extensions released and deployed.