I don't have a "complex de vira lata". Brazilians are awesome, it's the whole public sphere and its incentives to push down on the population that stinks. :) Y

I don't have a "complex de vira lata". Brazilians are awesome, it's the whole public sphere and its incentives to push down on the population that stinks. :) You are wrong about package trust. It is indeed signed by people but anyone is still able to verify it, even obscure blobs like IME. The same can't be said about the firmware of the voting system audited by a few chosen. Mentioning CAs is a straw since there are degrees of trust. A let's encrypt certificate on acesso.gov.br (I guess in the end they gave up on trying to shove that bogus CA?) just means the host matches the certificate. The contents are malicious. And about where we disagree you trust a set of governmental entities to audit the government while I find the idea preposterous.