3 ms·
Nope, it’s the same. I believe the blog post is trying to say that including the key in the git object storage is effectively the same thing as self-signing, si
by woodruffw 3y ago
Nope, it’s the same. I believe the blog post is trying to say that including the key in the git object storage is effectively the same thing as self-signing, since there’s no independent key discovery or trust mechanism. In other words: it’s not because it’s a private key, but because putting a public key in the same channel that it’s meant to verify is essentially “useless” from a verification perspective.