Again, that's why we want to add signatures to packages. This is probably always going to be a two tier system though (some people are likely to not add a signa

Again, that's why we want to add signatures to packages. This is probably always going to be a two tier system though (some people are likely to not add a signature). There are other possible security systems as well, like MELPA could use github and say "yes, this package is authorative from there".