We are using an internal debian repository for backports and internal software.
We chose reprepro to manage the repository, and we sign source packages (with debsign) so that the repository accepts our gpg keys as trusted.
We created an internal keyring similar to the debian or ubuntu keyring package, that we install before anything to be able to run "apt-get update" without getting any gpg key error.
The latest point is problematic, as we often get security related issues, although we are in a completely private network, which excludes unsafe package uploading from outside.
Question : What are the pros and cons of using signed packages in an internal repository ?