add: so thanks to bascule and michaelt i now realise that the idea is basically increasing the cost to the attacker. by serving the signature and the file from

add: so thanks to bascule and michaelt i now realise that the idea is basically increasing the cost to the attacker. by serving the signature and the file from different servers, the attacker has to compromise both servers. by signing with a private key and publicising the public key, the attacker has to compromise either the private key storage or all the public key storages. thanks a lot.