32-bit OpenPGP key IDs on download page

[jwilk]

https://www.python.org/downloads/ uses 32-bit OpenPGP key IDs.
This bad, because 32 bits is so short, it's computationally trivial to generate a new key with chosen ID.
In fact if you run the suggested command:

gpg --recv-keys 6A45C816 36580288 7D9DC8D2 18ADD4FF A4135B38 A74B06BF EA5BBD71 ED9D77D5 E6DF025C AA65421D 6F5E1540 F73C700D 487034E5

you will get not only keys of release managers, but also two sham keys.

Please use 64-bit key IDs or, preferably, full key fingerprints.

[berkerpeksag]

This is something needs to be discussed with the current release managers. There is not much we can do here as www.python.org maintainers. Could you please send an email to python-dev about this? Thanks!

[ned-deily]

@jwilk, thanks for the report. @berkerpeksag, I'll take care of this one.

[ned-deily]

I have updated the website to display the 64-bit form of people's keys and, in most cases, link to their keybase.io entry which contains the full fingerprint.