[tex-live] tlmgr: Package verification

[Philipp]

As I just had to install Texlive on a new machine, I realized that I
don't understand the difference between "--require-verification" and
"--verifiy-downloads".

I installed from DVD, changed the repository afterwards to the CTAN
mirror and then ran "tlmgr update --self --require-verification" and
"tlmgr update --all --require-verification".
Is this sufficient to ensure that all downloaded packages are actually verified?
According to the manual, "verify-downloads" seems to be set to true by
default, so I guess one doesn't have to deal with that option unless
one wants to disable it?
What would happen if one combines "--require-verification" with
"--no-verify-downloads" or vice versa?

I also wanted to have a look at the config files for tlmgr to have a
look at the default values, but it seems that neither a system-wide
nor a user-specific file exists. Is this correct? (kpsewhich
-var-value=... lists paths for both, but the system-wide path only
contains a file named "ls-R" and the user-specific doesn't even
exist).

Regards,
Philipp