[brl]

Yawn. Let me know when you're ready to announce a project to competently sign and verify artifacts.

[brianefox]

Signatures have been required on Central for years and there are tools to verify them, including repository managers.

We strongly do not believe that you should entrust your private key to anyone else for signing, which is what others have done to make it easy....yet less secure.

[jamespo]

Maybe you could assist them?