One could create a registry that uses PSK similar to mobile applications so a install only auto accepts an updated package if it's signed by the author. Would

One could create a registry that uses PSK similar to mobile applications so a install only auto accepts an updated package if it's signed by the author. Would prevent the issue above.