Leaked keys must be revoked. Whether it's the appstore developer key of a key to sign website packages with. The main difference is that Apple provides a manag

Leaked keys must be revoked. Whether it's the appstore developer key of a key to sign website packages with. The main difference is that Apple provides a management tool for revoking a developer key, and that OSS projects must have their own trusted server where they publish their public keys (and issue a revocation in case of GPG). I realize that this often is not the /easy/ way. But IMO /no/ software is worth running without verifying its integrity. The good news: the more you verify your downloads, the easier it'll get :)