Comment Re:Ignoring the hysteria... (Score 1) 21
Well, Debian has signed updates. I assume most other distros do. I'm not clear what the benefit of this is. Who are you going to trust to do the signing? Does the entire system need to be resigned after every update? At first glance this only works if your entire system is in one "file", and you sign that file with a unique signature. But who's going to know what the proper signature is?
Signing individual packages seems much more reasonable. Then two people can compare the signatures on a particular piece of software to determine that they are the same. (But for that, why rely on signatures when things like sha256 exist...unless that what they mean by signature, in which case the prior caveats still apply.)