> So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Not true. The GPG signature means the key be

> So each package has been signed, but anyone could have issued the keys, so an attacker could easily do the same. Not true. The GPG signature means the key belongs to an account with access to the group id (namespace, usually a domain), and that sonatype has verified the group id belongs to the original admin account for that group id. It's not a lot of guarantees, but you cannot just generate a GPG key, sign a package, and publish to maven central.