Most linux distros have used signed repository packages since forever, right? Not really challenging what you are saying, rather asking whether this is not alre

Most linux distros have used signed repository packages since forever, right? Not really challenging what you are saying, rather asking whether this is not already a very similar setup. I guess it is a social web of trust among package maintainers as opposed to the certificate authority root of trust in Windows. Or am I making a flawed comparison?