IIRC Common Lisp&#x27;s asdf-install did use GPG signing from developers; IIRC-again, most people disliked it.  Now quicklisp exists, which does _not_ use GPG; a quick google didn&#x27;t reveal any info on package authentication.  Maybe a lisper can chime in?