In the lastest versions of CPAN, Module::Signature will be used if available. In theory I think this is a great idea, but in practice it is seeming to cause more harm than good. I've come across several modules with invalid SIGNATURE files/missing gpg keys on public servers (and yes I've contacted the authors). I'm sure that Module::Signature can be optimized to handle the missing gpg keys a little more robustly (currently a missing public key means the module cannot be installed through CPAN/CPANPLUS), but I personally would like to see a CPAN/CPANPLUS option to make gpg signature checking optional while the Module::Signature code matures a bit more. I know that I can simply remove Module::Signature, but I have to script this on a variety of platforms and I cringe at the idea of trying to handle this safely.