Nikodemus Siivola <nikodemus@random-state.net> writes:

Imagine: somehow the key gets stolen. Now the purveyor of the key can sign stuff as Common-lisp.net, including keys of maliscious package authors, which people will then install and run because the author's key was trusted by Common-lisp.net...

Ok, good point. So, who gets to know the key, then? Erik.