Earlier quoted context omitted.
The pull-requests for new packages are manually merged (as it the case now), automatically signed. Names uniquely identify one package. A repository maintainer can replace the owner of a package, and clear the existing package contents. This shouldn't be done for a different package with the same name if any users still have the package installed, though, as they will consider that an up/down-grade. Hope that clarifi…
That does help me a lot - thanks! The manual "pre-approval process" via accepting the PR is what I was missing, and that does seem to fix most of the shortcomings of the underlying system (assuming a reliable human!) So you have a human that looks at incoming requests to prevent abuse, and to arbitrate problems. And then the snapshot server signs that result to allow distribution over HTTP, and then periodically it g…
What is nice is that the moderation, if given the proper reports, e.g. Travis with lint and security checks, is very fast in the simple cases, and readily opens discussion in the others -- that's where GitHub really shines.
I mentionned GitHub, but note that we intend to also provide the tooling to host your own signed repository, indenpendently of it.