Maybe consider arranging distribution packages to automatically make GPG configuration available, and then default to --verify on in distributions by default?
Maybe consider arranging distribution packages to automatically make GPG configuration available, and then default to --verify on in distributions by default?