Why Does Debian Use PGP to Sign Packages

[email protected] Sat, 16 Aug 2025 01:22:41 +0000
Newsgroups gmane.linux.debian.devel.security
Message-ID <[email protected]>
Hello All,

In an earlier post I asked why Debian uses PGP to sign packages despite 
its complexity.

Some responded that Sequoia PGP simplifies the process.

I now wish to ask why Debian uses PGP in general to sign packages when 
there are alternatives such as SigStore.

What were the unique benefits in PGP that could not be found in other 
alternatives?

I thank all in advance for any responses.

Best,

Tanveer Salim