It helps that signing packages for Linux distributions costs $0, since they all use GPG. I actively avoid adding repositories that aren't signed with GPG keys f

It helps that signing packages for Linux distributions costs $0, since they all use GPG. I actively avoid adding repositories that aren't signed with GPG keys for this reason, though it still doesn't protect me from compromised keypairs.