notary

You're right, wrappers can abstract away complexity. That's effectively what TUF is: a wrapper framework around low level crypto primitives that achieves a secure content distribution system. GPG alone would not have given sufficient guarantees around freshness and survivable key compromise. TUF should be understood as a higher level concept than GPG. There are additional features of the TUF spec that we'll be implementing in later versions, such as threshold signing (k of n signatures required for verification) and secure delegation. For what its worth, TUF could be implemented on top of GPG just fine. If folks have an appetite for that we'd welcome contributions here: https://github.com/docker/notary

Checkout docker-notary [0] a tool for checking signatures that you can pipe in between the download and execution of the script. [0] https://github.com/docker/notary

Docker addressed this last week at dockercon, announcing Docker Notary to securely publish and verify content. https://github.com/docker/notary

Came to my attention since Dockers new project notary leverages it: https://github.com/docker/notary