they could allow for configurable security, like allowing users to specify a gpg public key. Doesn't have to be the default.