Even more precisely still, not even the lists of packages are signed. Only InRelease and Release are signed, and they only contain the list of Package files.

Even more precisely still, not even the lists of packages are signed. Only InRelease and Release are signed, and they only contain the list of Package files. It's FreeBSD that has the approach of just one signed file containing everything. APT has moved closer to it over the years, but it is not there yet. * https://unix.stackexchange.com/a/332441/5132 https://unix.stackexchange.com/a/332441/5132