Thanks, Dave_L!
I was talking to one of my buddies last night after I got off work, and he said something like this too. Each plugin gets two keys: one that is a timestamp or something, and one that is a md5 hash of my secret word and that timestamp. These are displayed to the user before he installs the plugin, and he's promted to go to my site to verify the plugin. I then have a script set up on my site where he enters both keys, the script does all the checking, and tells him whether it's valid or not. This would be an optional step, Xenon itself would still be able to install an invalid plugin, but hopefully the user would be smart enough not to install it if it shows up that its not signed properly or whatever. Part of the timestamp key would also have an identifying number that matches a certain plugin - so that when the user verifies it, when it does pass the test it will say "This is a valid key for [Plugin Name Here]" - that way the baddies can't reuse a technically valid key for every new file they make (or they can, but the user will know that's what they're doing).
Thanks again
I like the plugin file contents idea, I'll see what I can do about getting that to be part of the process too, since it does seem more secure.
---Jamin
