You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It's nice that there are .sigs and the public keys used to sign them in the repository, but wouldn't it be best to point users to download the keys from https://pgp.mit.edu or another key server?
That way they can visually see the WoT and independently verify that the bundled public keys and signatures are not falsified. I mean, you'd have to be an idiot to fall for fake sigs due to the nature of timestamps and IDs, but it's probably good practise to enforce for a user's sake.
Dunno. Just my two cents.
The text was updated successfully, but these errors were encountered:
It's nice that there are
.sig
s and the public keys used to sign them in the repository, but wouldn't it be best to point users to download the keys from https://pgp.mit.edu or another key server?That way they can visually see the WoT and independently verify that the bundled public keys and signatures are not falsified. I mean, you'd have to be an idiot to fall for fake sigs due to the nature of timestamps and IDs, but it's probably good practise to enforce for a user's sake.
Dunno. Just my two cents.
The text was updated successfully, but these errors were encountered: