And even the established ones which do require signing are not really trivial to use correctly: http://branchandbound.net/blog/security/2012/08/verify-depen...