[matthuisman]

that still doesn't solve half of the issues.
That just makes sure your getting the version the author intends.
A simply checksum in addons.xml solves the same issue.
The author can still be bad.
The bad addons can still come pre-installed on builds etc.

Yes, installing the key shows you trust them.
But so does installing their repository.

I'm happy for suggestions as long as it solves all the issues at the top of that post.