Ubuntu-make (umake) security: package signatures?

ubuntu-make (umake) can be used to install the latest version of a variety of popular developer tools.

How secure is this process and how does it compare to the security built in to apt-get, such as digital signatures via keys that are not stored on the repository servers, secure, automated updates when security vulnerabilities are identified in tools, etc.? Apt has an apt-secure man page with details on the apt approach to security. Does umake have anything like that?

Does umake, or the processes that create the packages it delivers, check any digital signatures on the underlying packages, including e.g. Maven Central signatures? How are the signature keys vetted? Does the process create any signatures that umake, in turn, automatically checks? These steps seem important, as discussed at Is Maven a plausible vector of attack? - Information Security Stack Exchange

I see that umake doesn't do updates yet (updating tools · Issue #74). Is there any way to determine whether a given installed tool is out-of-date, so you know when to do the "remove/reinstall" workaround? Is there any way to check installed umake tools for security vulnerabilities? Is the archive of packaged tools and any associated version and security metadata available for inspection directly over the web? If not, is it available via umake? What format are the packages and metadata in?

Finally, are there any plans to use The Update Framework (TUF) to really deal with software updates in a secure way?