A mirrored package manager, where signature and executable are always grabbed from different sources.
Like apt, dnf, and others.
Pretty sure my apt sources have the signing and package pointing to the same place
Pretty sure my apt sources have the signing and package pointing to the same place