3 ms·
> What about hosting HTTP content because you verify GPG signatures upon download? Because the rest of the content is not verified?????? That's the whole point
by staticassertion 9y ago
> What about hosting HTTP content because you verify GPG signatures upon download?
Because the rest of the content is not verified?????? That's the whole point of HTTPS????????
- pwnna 9y agoI didn't downvote this and this is a valid misunderstanding. The whole point of having GPG is that you (as the distributor/debian repo/whatever) have already somehow distributed the public key to your clients (customers/debian installations/whatever). Having HTTPS is redundant as it is presumed that initial key distribution was done securely.