I don't think registering a URL to an XML file does the trick.

The Linux distro's typically sign the packages, saying they were presented to the distro by someone they trust.

You need some sort of security in place, otherwise the system is effectively trusting all the web servers in all the URLs, and we know how safe web servers are.

But yes if Microsoft update updated everything, then people would have motivation for running it. Where as if it just updates a few system and Office - things that no one cares about till there PC is spamming - where is the motivation?

But it boils down to the same thing, trusting a single central authority, and since Windows users implicitly trust Microsoft, it might as well be them.

You see the thing is most of the GNU/Linux installs I've done are because the software I (or my clients) wanted to run didn't run on MS Windows at all, and much of it still doesn't (or runs poorly - we fork() fork() fork() fork() fork() fork() fork() it is what we like to do).

So what you are saying is we should write non-portable must-have applications for GNU/Linux desktop, and we'll win the desktop share battle. Unfortunately for the adoption of GNU/Linux being wholly dependent on software that only runs on one platform is just the kind of situation many of the users are trying to avoid.