[Macha]

Basically all Linux distro package managers?

[saghm]

That's fair, distro package managers use it. I don't know of any language that uses it though; I think NuGet uses certificates for signing rather than PGP.

[exabrial]

All of maven central? Is that also significant enough (as well)?

NIH nihilism