Actually, on second thoughts - yes, you are right. This could work - partially. But the other way around. Mozilla could build the blobs, sign them and then send

Actually, on second thoughts - yes, you are right. This could work - partially. But the other way around. Mozilla could build the blobs, sign them and then send them to Cisco who would then provide the download infrastructure. It still won't allow a third party to verify the same and would require everyone to trust Mozilla itself. Its less problematic than having to trust Cisco, but far from ideal. On that note: do you know if the blob download would be wrapped in a Cisco EULA?