> Usually GEMs are not cryptographically signed! This can lead to security issues! It is possible to sign GEMs, but it’s not mandatory and most developers don’t sign their GEMs.
Unfortunately, Nobody Cares About Signed Gems: http://www.rubygems-openpgp-ca.org/blog/nobody-cares-about-s...
We've tried making a difference in Phusion Passenger by setting an example, and supporting gem signing (http://www.modrails.com/documentation/Users%20guide%20Nginx....). All Phusion Passenger gem releases since 4.0.0 RC 4 (1 year ago) are signed. All our other gems (default_value_for, etc) are also signed. Unfortunately not many people followed.
We'll continue to sign all our stuff, but it's sad that it never took off community-wide.