Using gpg-authenticated debian-archives

apt-get install gnupg debian-keyring ; gpg --recv-keys 4F368D5D

For people running an archive repository

(taken from http://wiki.debian.org/apt06 - go to that page and read it!)

If you run a archive make sure that you have a toplevel Release file (create it with apt-ftparchive release) and sign it a key (with gpg -abs -o Release.gpg Release). Then tell your users what key they need to import.