suggestion: signed summary file

[0-wiz-0]

A cheap way to get package verification would be:
Let bulk builds provide pkg_summary.gz.asc signatures for the summary files.
Extend the summary files to contain a checksum for the binary package.
When downloading summaries, check the signatures of the summaries against allowed keys.
When installing packages, check the checksums of the binary packages against the summary file.