Another bug report [0] contains more details: This is dangerous as it is insecure default behavior. There may be an argument (poor) for keeping insecure de

Another bug report [0] contains more details: This is dangerous as it is insecure default behavior. There may be an argument (poor) for keeping insecure default behavior. However, it is also doubly dangerous because it may imply to the user that the operation has been cryptographically verified when in fact it has not. Reproducible: Always Steps to Reproduce: 1. emerge-webrsync 2. "Fetching file portage-20161021.tar.xz.gpgsig ..." Actual Results: User things "cool, it's verified"... but it's not verified, and no warning is shown to this effect. Expected Results: All downloads are cryptographically verified or, failing that, a big (preferably red, flashing) SCARY WARNING is shown. Probably it should whinge immediately and require the addition of an --insecure command line flag. [0] https://bugs.gentoo.org/show_bug.cgi?id=597800 https://bugs.gentoo.org/show_bug.cgi?id=597800