2 ms·

I'm talking g about developers signing the archive on their local machine. Private key would be stored on developers laptop

• Xylakant 14y ago
  You still need the public key to validate the signature. If the attacker can change the public key, he can change the signature without you knowing - unless you explicitly want to trust each and every key for every gem you install.