Okay, as far as I've researched, to install software from a repository an identification key is used to sign a file (not encrypt it). We get the public key and the maintainer of the repo has the private key. The private key is used to sign a file and the public key is used to validate the authenticity of them.
So we need to register both the repo and the public key in our system.
But there are some cases where you just register the repo without the need of a public key and you can download packages from those repos.
Well, that's what I've understood so far.
For example: To install MSSQL you need to register the repo as well as the public key. But with NodeJS you just register the repo.
So what's the difference between using or not using a key? I know that it is to make sure that I'm getting the package from where I think I'm getting it from, but how does the system validate those packages coming from those registered repos with the keys registered in our system?
Basically, what's the workflow? That's what I'm trying to understand.