My specific point was made in context of maven central repository. It gives a false sense of security when you have to have a signed pgp key but no challange f

My specific point was made in context of maven central repository. It gives a false sense of security when you have to have a signed pgp key but no challange for trust.