Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / content unless it has been digitally signed by a certificate held only by the website administrators?
Exceptions could be made for user uploaded content like photos, and
shell_exec could be made to enforce digital signature verification for any "images" / code they execute.
Why is this not common practice? It certainly wouldn't stop all attacks - SQL injection and XSS would be essentially unaffected, but it could immediately stop almost all remote code execution attacks and website defacing. Is there some downside I am missing? It seems so simple and effective.