Another tool that generates compatible signatures: https://jedisct1.github.io/minisign/ https://jedisct1.github.io/minisign/ The main addition is a "trusted co

Another tool that generates compatible signatures: https://jedisct1.github.io/minisign/ https://jedisct1.github.io/minisign/ The main addition is a "trusted comment" line, that can be used to verify metadata, instead of just the content, for example to verify a timestamp and prevent unwanted downgrades. This is not an issue with packages, but it can be an issue with files that don't contain any version/timestamp. And since keys are very short, they can also directly be given on the command-line, making the verification very simple from a user perspective. For example the list of public resolvers compatible with DNSCrypt can be verified with a oneliner: https://github.com/jedisct1/dnscrypt-proxy#dnscrypt-enabled-resolvers https://github.com/jedisct1/dnscrypt-proxy#dnscrypt-enabled-... OpenWRT is now also leveraging Ed25519 signatures to sign their packages, using a slightly modified version of signify. The result is way smaller than GPG, and a better fit for embedded systems. Unfortunately, they sign `sha512(message)` instead of the message itself, making the signature incompatible with signify. But even though they only do one thing, these tools are overall way easier to use than GPG, way smaller, and having short keys is really great.