And even the established ones which do require signing are not really trivial to use correctly: http://branchandbound.net/blog/security/2012/08/verify-dependenc

And even the established ones which do require signing are not really trivial to use correctly: http://branchandbound.net/blog/security/2012/08/verify-dependencies-using-pgp/ http://branchandbound.net/blog/security/2012/08/verify-depen...