Traditional code signing does not protect against manipulation during the build process; ephemeral environments with short-lived keys and Sigstore offer more effective security.