- only possible upgrade path for packages installed from Makefile.extras - leave it disabled as we don't want third-party APT sources in the default setup - the GPG signing key is not trusted by default and must be manually trusted by the administrator