While this sounds like a good idea at first and many users actually do it this way (= unchecked import of keys), apt can't do it for security reasons and adding it (anyway) as an option would just mean we encourage this behavior further.
The signing keys of a repository ensure that the data apt downloads is actually what is provided by the repository and not tampered with by an attacker. That means through that the key needs to be acquired in a way which is secure from tampering. Importing a key from a keyserver is NOT SECURE. Not even if you use a TLS enabled protocol (which gpg doesn't by default). You can make it "secure" if you can verify that the key you got from the keyserver is what you expected to get. Signatures are a good thing for this, but now you need to know that the signatures are good… aka: You need a trust path from the key to you. APT can't create nor validate such a trustpath. As much as we all love automation, adding a key to apts trusted keyring is a very serious action which needs careful attention and in the end manual work to establish a trust path. If you don't do it, your system is not secure anymore as an attacker who can trick you into trusting the wrong key can subsequently trick apt into installing whatever he wants including keyloggers, bots and trojans as root, with full disk, (local) network and internet access (aka: The holy grail). This isn't too common yet in the internet at large as the linux marketshare is low, but e.g. daily practice in the Tor network and various leaked documents hint in which direction we are heading as everything a governments can do, can also be done by (non-government) criminals sooner or later. ** Changed in: apt (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apt in Ubuntu. https://bugs.launchpad.net/bugs/1456275 Title: Feature request for APT Status in apt package in Ubuntu: Invalid Bug description: I would like to ask for the feature that APT automatically imports the needed keys for all repositories from the sources.list while executing the "apt-get update" command. This would make the repositories management much easier (mostly for not very advanced users) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1456275/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp