| Subject: | Verify that key which signed file belongs to the author |
There is no verification that the key used to sign modules does in fact belong to the author. So any mal-intentioned person could modify a module, sign it with a key that has been uploaded to CPAN (perhaps even one which has the author's E-mail address), and post the module on a web site, etc.
There needs to be a way for CPAN authors to register or post their keys (this requires a change to PAUSE/CPAN infrastructure) so that Module::Signature can obtain their key and use that for verifying the signature.
(Whether anyone associated with CPAN etc. signs keys or builds a web of trust is another issue.)