bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed

[Stefan Monnier]

> Eg if clients automatically (even with prompting) install public keys
> from the package server the first time they connect, then this leaves
> zero protection against a man-in-the-middle attack. I connect to
> something that says it is elpa.gnu.org and install the key it offers.
> I have no way to know if it really is elpa.gnu.org.

SSH does it this way and nobody really complains loudly about it:
basically, you have to trust the initial connection, but not subsequent
ones (since you already have the key at that point).

> (With elpa.gnu.org we should distribute the public key in the Emacs etc/
> directory.)

Yes.


        Stefan