> - This may or may not mean that major distributions binary packages will simply stop being verifiable - it depends on who uses what key server in what chain o

> - This may or may not mean that major distributions binary packages will simply stop being verifiable - it depends on who uses what key server in what chain of trust. We probably won't find out till more bad actors poison more wells Debian keys come from keyring.debian.org, so ??? I'm guessing that chains of trust from there go through the SKS keyservers. If that's so, Debian updates will likely be hosed at some point. Unless you disable authentication. I have noticed that Whonix now includes onion links to repositories. So maybe that'd be safe enough without GnuPG authentication. Yes? Edit: It does look bad for the Debian family: A recent guide[0] recommends pulling missing repository keys from hkp://pool.sks-keyservers.net: > sudo apt update 2>&1 1>/dev/null | sed -ne 's/.NO_PUBKEY //p' | while read key; do if ! [[ ${keys[]} =~ "$key" ]]; then sudo apt-key adv --keyserver hkp://pool.sks-keyservers.net:80 --recv-keys "$key"; keys+=("$key"); fi; done Just tweak that a hair, and you have a list of all Debian package keys in the keyserver. How long before some jerk hits them with trollwot? I wonder how many millions of Debian family installs could be blocked from updating. Blame the SKS people, the Debian people, or whatever you like, but this could turn out very painful. The only bright side, which seemed like a bug until this shit show, is that Debian etc by default don't search for missing keys. 0) https://www.linuxuprising.com/2019/06/fix-missing-gpg-key-apt-repository.html https://www.linuxuprising.com/2019/06/fix-missing-gpg-key-ap...