I'm running 2 Arch systems---one a Gateway desktop, the other a Lenovo lap.

both running the most current Arch + XFCE, both updated regularly.

since pacman 4.03, pacman has a new "feature"--signature (key) checking on packages. Somehow, the Gateway has been updated with no hitches. The Lenovo, OTOH, is squawking at me that the signatures are all wrong---and the basic pacman-key commands are not helping. eg "pacman-key --init" hangs the computer.

Two questions:
1. Why did we need this new feature? (and are other distros doing this?)

2. Anyone else here having similar issues?

pacman-key --init does not "hang" your computer, you just need to make some random "noise" simple way to make that noise is to start the key init process, open a second terminal and do a few dozen times "cat /proc/sys/kernel/random/uuid" unit the init job is done...

see http://www.archlinux.org/news/having...rify-packages/
and https://wiki.archlinux.org/index.php/Pacman-key

• Q:1] Yes we need Signing because we can verify that those packages you get from a mirror originate from the main server and where created by the original packager from who you now hold the keys.
  
• Q:2] If you run in these situations read the News section first on http://www.archlinux.org/news/

Lol.

I used to trip up on Arch all the time - soon became a habit to go look at the homepage (rather than my saved link) every so often just to keep an eye on the upcoming news. Had way less unusable (Arch) systems after that ....

thanks for the inputs!!---As soon as my caffeine level reaches operational status, I'll try again.

Are any other distros doing something similar?

You can modify your pacman.conf ( /etc/pacman.conf) to ignore that feature. I did because I find it quite annoying. I have been a Arch user for just under a year and have had no issues.

Great idea but the "Siglevel = Never" as a global option will be phased out soon.
Future versions of pacman will get a separate SigLevel for the pacman -U from your local packages made from AUR pkgbuilds and "SigLevel = Optional TrustAll" can be used for your own repo server

No fun