> Their signed package formats (there are two) add extra sections to the `ar` archive for the signature APT does not verify package-level signatures (and nobod

> Their signed package formats (there are two) add extra sections to the `ar` archive for the signature APT does not verify package-level signatures (and nobody uses them anyway), so this is irrelevant.