I would like to ask if it is possible or feasible to have APT decrypt gpg encrypted packages as it downloads and installs them, or if I would have to write a script that decrypts and installs the files after apt downloads them to a local directory.
I am using https://packagecloud.io and it is so whenever I reinstall my system from scratch I can just add my apt sources and type in a package that I need such as SC-Squid-Config or SC-Full-Install (which selects everything as a dependency including SC-Squid-Config). I am deciding to use APT as I am getting tired of having to backup data to my USB External HDD and trying not to lose the data.
The idea is to only have to back up my gpg private key and the public key to the repo plus the repo url itself. If it's not possible, then I will just write a script to do the decryption after downloading the packages, but it would be nice to have this system in place.
Another end goal is to get rid of as much metadata as possible and that includes randomizing package names, and encrypting a metadata file which would handle info such as file names and directory names of the files inside the packages. I plan on doing this in addition to encrypting the file contents so one cannot easily identify any data inside the packages. (This was originally thought up as I was originally going to host this in a git repo).