> Granted it wouldn't save those adding a new package to a project the first time
Right, that's the real problem.
Right, that's the real problem.
also, this is a problem that every package mgmt system faces. they alert on changes on upgrade but there's a requirement at the end user level to verify that at install time, the cert being trusted is the right one.