Please sign Packages

[jk779]

Hi,
just found out that you don't sign your packages (unlike "normal" arch-dev's do).
Please sign them and provide the trusted keys.

I simply can't install packages from *some* mirror that could possibly be manipulated.

Thats a real blocker for me. I have to go back to Raspbian.
I'm using Arch on my Desktop and would love to run it on my Pi, too.

Regards,
Michael

[kmihelich]

Signing packages in on our TODO list. However, all of our mirrors are updated by us via rsync push many times a day, bringing them to an exact state equal to our primary, unpublished mirror.

Use whatever distribution you want to.