3 ms·

But nation-states can do that for downloadable packages as well, perhaps even the verifiers for those packages...

• StavrosK 13y ago
  How?
• whadar 13y ago
  They can spoof the package and its key. If the root of trust (CA) is tempered as you suggest and the chain of trust is broken, I don't see how you can really secure it.