>but the article contends that it does not provide "meaningful" privacy which is not true. Which part is not true? >As others have commented here, signing is

>but the article contends that it does not provide "meaningful" privacy which is not true. Which part is not true? >As others have commented here, signing is not comprehensive in practice on a per-package basis. Great, lets fix that. It is orthogonal to HTTPS. Anything else? >No, but a bug left open in a bug tracker indicates an intent to fix. It also indicates that it did not have a low cost/benefit ratio. >This one is being marked WONTFIX, which is not OK. This point is already addressed under the "Why not provide HTTPS anyway?" section which points to the costs. This indicates strongly that the decision is about cost/benefit. If you have any ideas to lower the costs, propose them. I guess it would first require you to get familiar with all of the ground level logistical details, so maybe an unfair request.