Re: package.el + DVCS for security and convenience

[Stefan Monnier]

> Now, since everyone but Xue Fuqiao has told me that tying package.el to
> the DVCS is a bad idea, we need to decide how these signatures will be
> stored in the ELPA, and how they can fit into the existing ELPA
> structure.  Nic Ferrier's proposal of a "key package" seems workable;
> that package can be signed with the GNU ELPA maintainer's public key to
> bootstrap the rest of the process.

The signatures should be added to the `archive-contents' file.


        Stefan