My suggestion would be that enabling automatic package updates should require a public key that the author uses to sign their tarballs, or at least check in a s

My suggestion would be that enabling automatic package updates should require a public key that the author uses to sign their tarballs, or at least check in a signature to the repository if not using tarballs.