Re: ELPA security

[Ted Zlatanov]

On Tue, 18 Jun 2013 00:54:32 +0900 "Stephen J. Turnbull" <address@hidden> 
wrote: 

SJT> Ted Zlatanov writes:
>> CRLs are especially tricky.  Trusting a maintainer signature at the
>> archive level and verifying it for each package when it's
>> downloaded seems like a good compromise for Emacs.

SJT> Then there's no need for a signed or unsigned list.

We need a list of exceptions from the "normal" and we need to decide if
signed or unsigned is "normal."

Ted