Most linux distros have used signed repository packages since forever, right? Not really challenging what you are saying, rather asking whether this is not already a very similar setup. I guess it is a social web of trust among package maintainers as opposed to the certificate authority root of trust in Windows. Or am I making a flawed comparison?