I do not believe anyone is 'ptoposing' anything. All he said was that package
signing should not be taken as a silver bullet, for experience has shown that
the key's themselves are capable of being compromised if a vendor is
successfully attacked.
Exactly what I would expect from *.edu