"message": "Yes, each key was split into its own keyring to ease maintenance:\n\n$ dpkg -L ngcp-keyring|grep \u0027trusted\\.gpg.*\\.gpg$\u0027\n/etc/apt/trusted.gpg.d/sipwise-autobuilder-2011.gpg\n/etc/apt/trusted.gpg.d/sipwise-archive-2015.gpg\n/etc/apt/trusted.gpg.d/sipwise-archive-2010.gpg",
"message": "While I also think it would be nice to verify the contents, as otherwise a MITM attack could probably be mounted. Having to hardcode the digests here seems a bit ugly. The most secure option would be to sign the contents and ship the signing key embedded here perhaps, but then we go back again to having some key all over the place which is a pain in case we have to revoke and regenerate another one. :/",