Package signing and verification
Disclaimer: This post focuses on Debian-based and Fedora\/RHEL-based distributions and packaging. Everybody using a GNU/Linux distribution most likely knows that packages used by the given distribution are somehow signed and such signatures are somehow verified. Usually, this knowledge comes with the first requirement to import some key when an extra package repository is being added to the system (the standard repositories of a distribution use keys that are present and trusted by default).