3 ms·
The exact same problem exists with the channel that you acquire the public key you trust from. You’re still fundamentally trusting HTTPS to the package provider
by HL33tibCe7 3y ago
The exact same problem exists with the channel that you acquire the public key you trust from. You’re still fundamentally trusting HTTPS to the package provider - you’re just trusting it at a different point.
- nicce 3y agoUsually keyring is separate package which is also signed with a key which can be verified from multiple different sources. Of course, if you are a target of nation state attack, which fakes public keys from all sources by MITMn DNSs and servers, you might end up with the wrong package. But that threat model is totally different.