If you want to start with tinfoil hat theories, think about this:
The PGP signatures were removed, nominally because few people used them. ...but the timing of the removals is coincidental, no?
"You need to have a backdoor that lets us see who's downloading what packages and let us inject custom code to particular targets"
"That's technically impossible because of..."
"Here is a court order. Implementation is your problem. You're not allowed to tell anyone you even received a court order."
"...well, I guess signed packages have to go then..."
(:
I don't actually believe that, since PGP signing was frankly, barely used and really there's hardly any meaningful difference between a PGP you can't verify (which was most of them) and not having it; in fact the illusion of security is probably worse than not having it at all.
...but still. As you say. It sucks there's no meaningful replacement for it.
The PGP signatures were removed, nominally because few people used them. ...but the timing of the removals is coincidental, no?
"You need to have a backdoor that lets us see who's downloading what packages and let us inject custom code to particular targets"
"That's technically impossible because of..."
"Here is a court order. Implementation is your problem. You're not allowed to tell anyone you even received a court order."
"...well, I guess signed packages have to go then..."
(:
I don't actually believe that, since PGP signing was frankly, barely used and really there's hardly any meaningful difference between a PGP you can't verify (which was most of them) and not having it; in fact the illusion of security is probably worse than not having it at all.
...but still. As you say. It sucks there's no meaningful replacement for it.