Note that package signing wouldn’t even help if the signature history were archived and not referenced when new packages are resolved.
ok, thanks, so if we reserve the old names (by having a lint check that errors if a name that is present in the archive) - that would be sufficient (to avoid anyone taking over the package name).
3 Likes