The fact that we haven&#x27;t solved this yet is puzzling. It seems that we have actually gone backwards in some ways over the last decade. With languages implementing several broken distribution packaging systems trying to compete against each other. Not even to mention the horrible practice of piping random <i>sh1t</i> from the web with curl&#x2F;wget into a shell.<p>It would be more or less trivial to implement a wget wrapper that downloads the .sig and validates it. Hardly anyone these days understands or cares which seems to be the bigger issue (not a technical problem but a people&#x27;s problem as <i>Gerald M. Weinberg</i> would say)