Why Package Signing is not the Holy Grail (2013) | Hacker News Reader