5 ms·
Github doesn't have your private key, so they won't be able to serve a valid signature. The only thing they could do is to substitute an older signed version wh
by edwintorok 11y ago
Github doesn't have your private key, so they won't be able to serve a valid signature.
The only thing they could do is to substitute an older signed version when you request a newer version.
- ashitlerferad 11y agoThey could create a new private key using your name. Most people will trust 'Verified' on a web page more than the OpenPGP web of trust.
- sneak 11y agoNot sure why you're being downvoted, this "what is the threat model here" was my first thought, too, and this comment is also correct, as well.
- ashitlerferad 11y agoProbably my "Most people" quip.
- zokier 11y agoThe xkcd trust model https://xkcd.com/1181/ https://xkcd.com/1181/
- ashitlerferad 11y agoTo emphasise this, there is an evil duplicate of the OpenPGP "strong set" here: https://evil32.com/ https://evil32.com/
- makomk 11y agoMost people will, but this is written by a Debian developer and they're one of the few groups of people who actually make use of the OpenPGP web of trust.