As stated by Barbara, this was a temporary error, and since yesterday the files are signed again. This was due to the required expiry extension of the signing sub key.
We are taking/have taken the following measures:
- (already done)
tlmgr will require the main repository to be signed, and will refuse working if the main repository isn't. This change is in
tlcritical and will be pushed out after testing.
- (in progress) make sure that a signing error on the build server will prohibit the push-out to the CTAN servers
Concerning the comments about security by default: We thought about requiring signature in case GPG is installed, but initial testing brought a huge opposition against this move. Now that verification was running smoothly for one year we feel reasonably save to require at least a signed main repository.
Concerning sub-repositories we are not decided by now: First of all we cannot and don't want all repositories to be signed, this should be optional. The question is what to do with signed repositories if the user has not imported the public key to allow for verification. At the moment we accept such repositories, in the same spirit as Debian does.
Hope that clarifies the situation.