4 ms·
This seems more legit. If a user is signing their commits, other users should have access to their public keys in order to verify the signatures.
by giaour 5y ago
This seems more legit. If a user is signing their commits, other users should have access to their public keys in order to verify the signatures.
- megous 5y agoUsefulness of that access from the same service you're getting the signed commit from is close to nil. Public keys should be distributed in a trustworthy way.