Description: ------------ If a package contains a package.sig file, it should be used to verify the validity of the package. Currently, you can sign a package, that signature is used nowhere.

Especially with mirrors and other channel servers than ours, security becomes a great concern. Given that PEAR can be used as a general install tool, it should have the same security standards/features as other package managers have, and this means security checks by package signatures.

http://it.slashdot.org/article.pl?sid=07/05/31/1226222 is also a concern for pear as long as we don't check sigs and/or have ssl rest connections.