[Haskell-community] Hackage Roots of Trust

GershomB wrote:

One related discussion we started to have was if we might want to do haskell community funding for "phase two" of the update framework rollout, as discussed in Duncan's talk -- that phase where we not only implement server trust and signing, but also author signing.

This sounds like a project that potentially the community could consider valuable. However, how much total effort are we talking about here? How much funding would be required? PS: apologies for the top-post. Just signed up to the mailing list and didn't find a way to convince my mail client to set the in-reply-to field appropriately to reference the original message.