3 ms·
Sorry, I meant the PGP keys, not the signatures.
by meowface 8y ago
Sorry, I meant the PGP keys, not the signatures.
- Boulth 8y agoIf the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS. But the page that says "here's our fingerprint: xyz" would better be served over secure connection (assuming someone is not using WoT).
- meowface 8y agoTrue. When using PGP I'm used to just directly importing a public key listed somewhere. Either a key or its fingerprint (if one is provided) needs to be provided over a secure channel. But I guess it doesn't matter when the OS bundles the fingerprint or key and you're able to verify the OS image.