Signature checking is widely used. In every Linux distribution I&#x27;m aware of, package managers use signatures to check downloaded packages (and maintainers use their keys to sign packages). GPG is another widely used standard for signing open source software.