Quoting Keith Owens <kaos@ocs.com.au>:

> >Linus already signs his kernel releases.
> 
> No he does not.  The signatures on files obtained from ftp.kernel.org
> and mirrors are automatically generated by a script on kernel.org as
> files are uploaded.  The signature is by ftpadmin, not the person who
> put the file there.  It says nothing about who uploaded the file, it
> only proves that the file came from kernel.org and has not been
> tampered with since upload.

The idea is the same: the owner of the secret key signs the package.
That owner can be a human or a machine. You have to trust the owner.
Of course, automated signing is less secure and I don't think it
can be used in this project.

In fact, what the ftp server can do is to verify the signature of the
package after the developer uploads it. Only properly signed files,
from known developers, are permitted to stay on the distribution
site. Just another little bit of security...

Dmitri

-- 
panic("esp: Aiee penguin on the SCSI-bus.");
  (from linux/drivers/scsi/esp.c)