I see the point, in order for the other scheme to be successful the integrity check should use another supposedly trusted channel. True :-) Yeah Raspian (debia

I see the point, in order for the other scheme to be successful the integrity check should use another supposedly trusted channel. True :-) Yeah Raspian (debian's RPi clone) used GnuPG to check precompiled package signatures. sorry, my bad.