- can use existing keyring repos that we use for client - start with apt and dnf/yum but maybe add support for arch