3 ms·
And similarly GPG keys are at github.com/username.gpg
by erk__ 5y ago
And similarly GPG keys are at github.com/username.gpg
- giaour 5y agoThis seems more legit. If a user is signing their commits, other users should have access to their public keys in order to verify the signatures.
- megous 5y agoUsefulness of that access from the same service you're getting the signed commit from is close to nil. Public keys should be distributed in a trustworthy way.