Re: ELPA security

[Stefan Monnier]

>> And maybe automatically eliminate an archive from that "not signed"
>> list if we ever find a signature in it.

> If this is about security rather than adding to your BrightShinyThings
> collection, you should have a signed-and-verified-and-checked-for-
> expired-or-revoked-on-$DATE list, and eliminate any packages from the
> list if they fail any of the hyphenated conditions.

We're really far from that.  The config under discussion is one that
indicates whether it's normal that the archive (the whole archive, not
a specific package) doesn't have signatures.


        Stefan