I believe Debian uses a web of trust and irl verifications to build that web. Hierarchical trust like the x509 certs we use for https, sounds like a more convenient alternative.