> You want to check the validity of a commit at the moment you use it, not the moment the commit was made If you received the repo before the key expired, you

> You want to check the validity of a commit at the moment you use it, not the moment the commit was made If you received the repo before the key expired, you can still trust the signature even if the key has since expired, as the key was valid at that time the repo was signed. > imagine I put up a fake tree, with a fake commit with you as an author but made with a fake key that already expired Yes, you cant trust a key after after it's expiration. See bottom of https://www.kernel.org/signature.html https://www.kernel.org/signature.html for how the kernel.org folks handled this in 2011. Once they re-signed the release, it's safe to trust the compromised key within that release. > I don't understand what's the link with the rest of the discussion We're discussing complexity of pgp adoption, security cards simplify the usage of pgp, thought it was relevant.