[arch-dev-public] Mishandle of the 'Use gpg signatures and https sources' TODO list