It's easy to forget that .edus and even .coms can and will have internal repositories that desktop installs will be encouraged to use. These repos are absolutely and utterly hidden from scrutiny from any public authority.
Yes, but those people will ensure that people using the systems have the requisite keys preinstalled. At least they will if they're at all sane.