> Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't they? From yesterday: > the China-Based threat actor, Storm-

> Microsoft, Google, Apple etc are keeping the keys that allow you to push updates secret, aren't they? From yesterday: > the China-Based threat actor, Storm-0558, used an acquired Microsoft account (MSA) consumer key to forge tokens to access OWA and Outlook.com. Upon identifying that the threat actor had acquired the consumer key, Microsoft performed a comprehensive technical investigation into the acquisition of the Microsoft account consumer signing key, including how it was used to access enterprise email. — https://news.ycombinator.com/item?id=37408776 https://news.ycombinator.com/item?id=37408776 I think Microsoft’s handling of keys is almost certainly far, far more secure than anything the British government would care to achieve.