16 ms·
If the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS. But the page that says "here's our fingerprint: xyz" would
by Boulth 8y ago
If the keys are referenced by the key fingerprint they don't strictly need to be fetched over HTTPS.
But the page that says "here's our fingerprint: xyz" would better be served over secure connection (assuming someone is not using WoT).
- meowface 8y agoTrue. When using PGP I'm used to just directly importing a public key listed somewhere. Either a key or its fingerprint (if one is provided) needs to be provided over a secure channel. But I guess it doesn't matter when the OS bundles the fingerprint or key and you're able to verify the OS image.