> That package was just something you googled that hasn't been updated in two years because maven has required signed packages forever. That something hasn't b

> That package was just something you googled that hasn't been updated in two years because maven has required signed packages forever. That something hasn't been updated in two years because it's feature complete and does what it's supposed to: verifies the integrity of dependencies for Signal [1]. > If someone gains access to my account and tries to modify my package without my private key it will not be accepted into the repo. This isn't true. Sonatype/Maven Central requires PGP signatures on all new artifacts, but there is no requirement to use the same key. It will happily accept a signature from _any_ key for new releases. [1] https://github.com/WhisperSystems/Signal-Android/blob/ae93038d6651b564f4957ecdcab7323346153bf2/build.gradle#L122 https://github.com/WhisperSystems/Signal-Android/blob/ae9303...