4 ms·

Any centralized E2EE service has the (public) keys; that's the only way to distribute them to users. You have to trust (or verify, in the case of Signal) them t

Any centralized E2EE service has the (public) keys; that's the only way to distribute them to users. You have to trust (or verify, in the case of Signal) them to deliver authentic keys rather than MitM'ing you.

g-b-r 6y ago
It wouldn't be a problem if anybody at all had the _public_ keys, I think he meant the private ones.