As Atomic moves from experimental to something users will actually depend on, we need to get this right. It's my understanding that the current workflow doesn't make it easy (the signing needs to happen in a place different from what we're used to).

I don't know the specifics, but as Dennis says, "we should figure something out. I just do not know what a good answer is".

The same thing might let us also sign RPM repo metadata.