Comment by Arnavion

Packages are signed in exactly the same way Debian packages are signed, ie the package files themselves are not signed but the index file that lists them is.