Hi! First off, I would like to thank you for the amazing work and effort you put into yay. It makes managing AUR packages a breeze!

Thanks to this video by DistroTube I learned about doas, a (much) smaller alternative to sudo. Or, as DT puts it, with "less bloat". ([already available in the AUR](https://aur.archlinux.org/pa

I have multiple packages installed from AUR which are offered for update every time I run yup but IMHO they shouldn't.

I.e. in todays output:

==> Checking for AUR updates...

==> Found 2 local package(s) that are newer than their AUR package
    numix-icon-theme-pack-git  r6767-1 has AUR version r6086-1
    ttf-consolas-with-yahei-powerline-git  r.-1 has AUR version r14.b6e9163-1

If packages/database uses signing then one needs to run gpg --detach-sign manually each time a package is added to the repo.

It makes sense if repoctl has an option to automate the signing process. i.e.

• run gpg signing for the package before adding it to database
• run gpg signing for the database after the package is added to database