Gah, that really rankles me. Is it too much to ask to have an obvious keystore that allows the user to decide what signatures to trust? Ideally self-compiled binaries could be self-signed and still protect from attacker supplied binaries.