Note that this is an important distinction from signing content using, for example, PGP keys. In that case, the signature is used to verify the content, not the producer of that content. For this reason, the PGP's web of trust will work. It cannot be used to trace users when they need to be banned, for in that case every user and organization should trust the keys used for signing. Placing this signature can be done automatically by the GDN tools for unloading content.
Signing takes place by means of a private key.
An uploaded package will now consist of signed content, and a certificate containing the public key for verifying the signature. When Bob downloads the package from Alice, he does two things. First, he verifies the signature against the content. In that case, he should reject it. Second, if the signature matches the content, he knows who produced that content.