I dont have an issue with a feature to allow my phone to automatically veirfy signatures. But there should be a way to import/configure more signature verification providers including my own authority and even then it should still allow imstall if user really want and trust it.