Tarball downloads by Debian maintainers are secured using OpenPGP and the uscan tool, there are lots of packages where the upstream doesn't do signatures though

Tarball downloads by Debian maintainers are secured using OpenPGP and the uscan tool, there are lots of packages where the upstream doesn't do signatures though. https://wiki.debian.org/debian/watch#Cryptographic_signature_verification https://wiki.debian.org/debian/watch#Cryptographic_signature... The Debian maintainers then sign those tarballs before uploading them to Debian. Verification of the repo -> tarball process is manually done by some Debian maintainers, not everyone does that though.