I don't run that kind of extension [0], but that's the reason I included this line: > That same entity compromised my browser, curl, my Linux laptop, Windows de

I don't run that kind of extension [0], but that's the reason I included this line: > That same entity compromised my browser, curl, my Linux laptop, Windows desktop, Android phone and 3 different networks. At least 3 platforms, potentially different 3 browsers, plus command-line. If I want to do this "properly" it's a lot of work. I'd get 3 or more independent VPN providers and run the test while connected to each, independently or in series. I'd run everything in a VM that I created from a verified source 5+ years ago on hardware from 10+ years ago[1]. I would have to categorize and confirm that every vulnerability in all software was either fixable via configuration, or couldn't contribute to remote compromise of the box. I'd run the test with and without Tor, hard-resetting the VM to its initial state for every variation and comparing the results across every run to detect abnormalities. I'd confirm the content at Archive, CommonCrawl, Yahoo, Google and at least one foreign provider, Yandex or Baidu or whoever else I could track down. I'd look for that same string in all places I could find it (web, newsgroups, torrents, friends, friends-of-friends), and confirm that neither those pages nor any linked pages contain invalidations, or if any of them contain further evidence to support the identity of said key. By "linked" I mean both links from those pages, and anything I could discover via search engine pointing to those pages independently. I'd go find some old torrents or archives of older versions of the binaries and/or signatures, and confirm that their content matches the published content. I'd confirm that the old key was in use before 0.11, and that the new key is indeed the one that signed release 0.11+. I'm sure there are some further steps I could take to invalidate any known or theorized attacks from state-level agencies, but at this point it's probably more difficult to fake than a GPG signature. And obviously I'm a sockpuppet - nobody should listen to random strangers on the internet without verifying their identity as well! You could look at my keybase profile, but A) that's easy to fake and B) that's not the key I used to sign above - clearly something hinkey is going on. ;) [0] https://chrome.google.com/webstore/detail/ext/apmlngnhgbnjpajelfkmabhkfapgnoai?hl=en https://chrome.google.com/webstore/detail/ext/apmlngnhgbnjpa... [1] https://libreboot.org/faq/#intel https://libreboot.org/faq/#intel