3 ms·
You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
by p4bl0 11y ago
You have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
- throwaway7767 11y agoAlso, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model. Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.