As part of setting up test cases for the crypto
in RPM, I had to generate random DSA/RSA keys.

It would not be hard to generate a random key,
include the randomly generated public key
in the headers, and _ALWAYS_ sign all built
*.rpm packages.

From an implementation and package integrity POV,
the benefit would be that all *.rpm packages would
end up being signed, and the RPM code paths become simpler
because there's less
	Have it your own way!
in *.rpm packages.

From a security POV, all depends on "trust", not existence,
of a digital signature. Whether a digital signature is verified
(or not) and whether a pubkey was randoimly generated (or not),
or whether the pubkey is included in the signed plaintext (or not)
has very little to do with "trust".

Should rpmbuild undertake always signing  built *.rpm packages
with a randomly generted (or known, a key pair is needed, how
that key pair is generated, randomly or configured, doesn't matter)
key?

73 de Jeff