@wolf480pl @domi @ignaloidas Yeah not 100% but pretty damn close.
The only reason is works differently for distro packages is because the package hosts are third-party (and so not where trust should be asserted) *and* there's end-to-end signatures in place.