DO NOT USE THIS INSTANCE FOR LIVE DATA!!!!
RPMs should be gpg signed just as the deb packages. Also add documentation how to verify to download page.