Signing protects authenticity and integrity, but it doesn’t really solve confidentiality.

If the weights are physically encoded in hardware and the attacker owns the device, the problem becomes hardware extraction: decapping, probing, imaging, side channels, etc.

You can make that very expensive, but it’s still a very different security model from keeping the weights in a datacenter.