Re: ELPA security

[Stephen J. Turnbull]

Stefan Monnier writes:

 > And maybe automatically eliminate an archive from that "not signed"
 > list if we ever find a signature in it.

If this is about security rather than adding to your BrightShinyThings
collection, you should have a signed-and-verified-and-checked-for-
expired-or-revoked-on-$DATE list, and eliminate any packages from the
list if they fail any of the hyphenated conditions.

And of course you probably want $DATE to change frequently.

And the list should be signed....