
This has been discussed quite a bit now. It is very easy to generate a signed repo on the server, and supporting unsigned repos adds complexity and security issues, including "BZ-01-002 TOFU Requests too easy to recognize and intercept" from the audit. https://gitlab.com/fdroid/fdroidserver/merge_requests/48 closes #12 https://gitlab.com/fdroid/fdroidclient/issues/12