• To make Module::Signature fail gracefully (fallback to simple SHA1 check without OpenPGP check) when used in an environment without network connnection. This has been done.
• Modify PAUSE to allow uploading of PUBKEY (or PUBKEY.txt) to the author's directory. That file is overwritable.
• PAUSE may also act as a local CA and sign each successfully uploaded PUBKEY. Consequently, individual PUBKEY files can be downloaded via http, rsync, ftp from any CPAN mirrors.
• It may be desirable to publish the PAUSE keyring as a master file, such as 05pubring.gpg.gz, which contains all PUBKEY files mentioned above.
• User _may_ choose to trust PAUSE, and by extension marginally trust each author's keys.

Of course, this is still pending furthur discussion with ANDK and other CPAN workers.

Thanks,
/Autrijus/