Prompt users to download TrueCrypt public keys from key servers?

[f3ndot]

It's nice that there are .sigs and the public keys used to sign them in the repository, but wouldn't it be best to point users to download the keys from https://pgp.mit.edu or another key server?

That way they can visually see the WoT and independently verify that the bundled public keys and signatures are not falsified. I mean, you'd have to be an idiot to fall for fake sigs due to the nature of timestamps and IDs, but it's probably good practise to enforce for a user's sake.

Dunno. Just my two cents.

[stefansundin]

Good point, I'll add it. Thanks!