Distributions are signing distributed packages with trusted keys by PGP. PGP signing is a fairly standard mechanism by which somebody can prove that he packaged

Distributions are signing distributed packages with trusted keys by PGP. PGP signing is a fairly standard mechanism by which somebody can prove that he packaged that software. The interesting bit is ... if a web of trust can be established, this is far, far more secure than distributing binaries by HTTPS. That's because the private keys with which those packages get signed DO NOT have to be distributed or installed on any public servers on this internet and thus this mechanism is invulnerable to exploits such as Heartbleed. And in the case of Linux distributions, this web of trust can easily be established, because the package maintainers and software authors know each other. In the right context, the web of trust model can be much more secure than SSL/TLS, because SSL/TLS requires X.509 certificates that have to be issued by a central authority - and we'll always have problems with central authorities that go rogue or have their root keys stolen. And you can't rely on the central authority model if you want protection against the NSA. Too bad that PGP signing/encryption isn't too popular, since the web of trust model only works if there are enough people vetting for each other. But for Linux distributions it works just fine ;-) Here, read more about it: https://en.wikipedia.org/wiki/Pretty_Good_Privacy https://en.wikipedia.org/wiki/Pretty_Good_Privacy