The important difference between a FLOSS system like Debian versus the walled garden of Apple is the ability to choose which keys you trust. If I lose trust in

The important difference between a FLOSS system like Debian versus the walled garden of Apple is the ability to choose which keys you trust. If I lose trust in one of the Debian signers I can remove that key. I can select a different repository to download packages from. Or I can stop accepting updates and apply patches manually. As to a key being a single point of failure, PGP allows for multiply signed documents. Couldn't Debian require packages to be signed by at least two keys?