Firefox addon unsigned security issue!

Currently addons.mozilla.org does not offer signed addon extensions, so if some unscrupulous person wrote a key-logger they could quite easily get people using their addon as everyone would trust the source. I'm surprised this hasn't happened yet actually.

Firefox as other security issues too, like even when I disable an addon Firefox still runs it upon startup! (Filterset.G. Updater for example). So you really have to uninstall the addons if you don't want them to run!