Since etch uses digital signatures for packages (http://www.debian.org/releases/stable/i386/release-notes/ch-whats-new.en.html#s-pkgmgmt), maybe "debsig-verify" is what you are looking for? -- Regards, Jörg-Volker.