[arch-general] Package signing: database signatures?

Hello everybody, afaik, database files in official repositories are not signed yet. Are they? This forces one to set SigLevel to 'Optional' instead of 'Required'. Now if anybody wants to provide an infected package he/she only needs to provide no signature at all and the package is happily accepted, no? So when will database files from official packages be signed? And even more interesting: Does it make sense to add a new option 'PkgRequired'? This could force valid signatures for packages and make it optional for database files. -- Best regards, Chris O< ascii ribbon campaign stop html mail - www.asciiribbon.org