Upstream signatures are prefered, especially verified - why not just add that
as a secondary source2 url? Or even better, make the SF one the default, as
it has all the files and more mirrors.
--
We cannot command nature except by obeying her. --Sir Francis Bacon
Have a sourcerous day! www.sourcemage.org