> let’s not let perfect be the enemy of good Agreed, I see people dismiss valuable but imperfect security too often. Google uses a similar approach for Androi

> let’s not let perfect be the enemy of good Agreed, I see people dismiss valuable but imperfect security too often. Google uses a similar approach for Android packages. In order to publish to the Play Store you need to upload signed with the same key. If you can't, then you submit a support request and they run some extra checks before they allow a new key. On challenge I don't see others mention I that an attacker could publish a small, non-malicious release first. Then any manual diff review wouldn't see an issue. The next release using the attackers key would be trusted, so manual review would be skipped, but that one would contain malware. This requires two releases by the attacker, over a period of time. Slowing down the attack is a benefit on its own. It gives package owners time to wonder, wait who pushed that last release?