>I'd really like the ability to be able to add digital signatures
>to a number of things, including binary packages, and to do that,
>I would need to add a program like gpg to the base system.

Why does it need to be gpg or even gpg like?  You can use
and openssl command line to generate a sig (though its lame that
you have to extract the pubkey from a cert).

--sjg