If GPG is missing, signature verification must fail closedAn optional GPG dependency can disable update verification. Require a verifier before processing the payload, then extract archives with explicit limits.20 April 2026·3 mins