4 ms·

I recommend RSA (GnuPG) or Ed25519 signatures with two key pairs: A weekly/monthly signing key pair, and a long-term one that is only used to validate the short

I recommend RSA (GnuPG) or Ed25519 signatures with two key pairs: A weekly/monthly signing key pair, and a long-term one that is only used to validate the short-term public key. https://scott.arciszewski.me/blog/2015/01/package-signing-thread-modelling https://scott.arciszewski.me/blog/2015/01/package-signing-th...

eropple 12y ago
That's an excellent way to ensure nobody checks your signatures, though. Making it hard means they will be ignored.
drdaeman 12y ago
Key rollover and certificate trust chains don't work in Android world.