Recently, verifying the binary took more work [1] than the install itself: * Verify SHA hash of binary * Verify .asc sig against binary * Verify sig appe

Recently, verifying the binary took more work [1] than the install itself: * Verify SHA hash of binary * Verify .asc sig against binary * Verify sig appears among dev keys list It was a good exercise though (and universally applicable). The (PGP) world before bundler, npm, pip... [1] https://www.apache.org/info/verification.html https://www.apache.org/info/verification.html