From 9e604368a4e1a2fd6f34659b8bf89a99832d61e2 Mon Sep 17 00:00:00 2001
From: Viet Anh Nguyen <vietanh.dev@gmail.com>
Date: Mon, 20 Jul 2026 10:18:58 +0700
Subject: [PATCH] docs(apt): say plainly what [trusted=yes] gives up

The install instructions hand users a flag that disables apt's signature
verification, next to a package that installs a root-invoked helper, with
no indication that either fact is true.

States what the flag does, offers the manual .deb path for anyone not
willing to take that trade, and points at the signing doc. Also adds
apt-signing to the Development sidebar -- it shipped in #35 but was
reachable only by knowing the URL.

These instructions revert to signed-by= automatically once a signing key
is configured; the release workflow generates the page from whichever
form it actually published.
---
 docs/.vitepress/config.mjs |  1 +
 docs/download.md           | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/docs/.vitepress/config.mjs b/docs/.vitepress/config.mjs
index 36c65c7..aa65d9b 100644
--- a/docs/.vitepress/config.mjs
+++ b/docs/.vitepress/config.mjs
@@ -43,6 +43,7 @@ export default withMermaid(
             items: [
               { text: 'Architecture', link: '/development/architecture' },
               { text: 'Packaging', link: '/development/packaging' },
+              { text: 'APT Signing', link: '/development/apt-signing' },
               { text: 'CSS Architecture', link: '/development/css' },
               { text: 'Icon Generation', link: '/development/icons' },
               {
diff --git a/docs/download.md b/docs/download.md
index a10a10f..08804c9 100644
--- a/docs/download.md
+++ b/docs/download.md
@@ -120,6 +120,22 @@ sudo apt update
 sudo apt install thinkutils
 ```
 
+::: warning What `[trusted=yes]` means
+This repository is not yet GPG-signed, and `[trusted=yes]` tells `apt` to install
+from it without verifying any signature. HTTPS still authenticates the server for
+the duration of the download, but nothing proves the packages are the ones our CI
+built — and ThinkUtils installs a helper that runs as root.
+
+If that trade-off is not one you want to make, download the `.deb` from the
+[releases page](https://github.com/vietanhdev/ThinkUtils/releases) and install it
+with `apt install ./thinkutils_*.deb` instead. You give up automatic updates and
+check for new versions yourself.
+
+Signing is implemented and waiting on a key — see
+[apt-signing](/development/apt-signing). Once it is enabled these instructions
+change to `signed-by=` and the `[trusted=yes]` flag goes away.
+:::
+
 ## Before fan control works
 
 One step is not optional, and it is the most common reason people think the app