From Jan Suhr:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Dear Yves,
> thank you very much for your effort! The certificate is for the control
> connection only, rigth? Does NWU care about PGP-signed packages? AFAIK
> NWU does just start apt-get to download and install packages (beside of
> other tasks). Would it be possible for an attacker to highjack a
> repository server and manipulate some packages? IMHO the packages should
> be verified before installation against (A) the usual
> Debian/Ubuntu/RedHat?/etc. repository keys AND (B) against packages
> created by the system administrator (the certificate which NWU should be
> configured to verify for). I don't think apt-get is doing such checks by
> default.
