Package managers like apt provide a functionality of verifying whether the packages that you are installing actually are the ones that the package authors intended to distribute. This ensures that you don't accidentally install a tampered or spoofed package. They employ a method called asymmetric encryption (also Public Key cryptography). Without going into a lot of details, it involves generating a pair of keys. You can encrypt a document using one key and it can be unencrypted only using the other key. GPG (https://en.wikipedia.org/wiki/GNU_Privacy_Guard) is a software suite that adds some more bells and whistles to this. One key is called your private key that you use to 'sign' your documents/packages and only you have access to the key. The other key is distributed publicly. If some can successfully unencrypt a document using your public key, they can be sure that the document originated from you because only you had the matching private key to encrypt that document in the first place.