Hi, I think we should start using PGP to sign tar distributions of sources and binaries PDQ. We should also be able to use Shen/SHTTP for this in the longer term BUT PGP does have the advantage of having a specific facility for this. Phill