Re: Checking signatures on source tarballs

[Alex Vong]

> What you suggest would be perfect but, if I understand it correctly,
> it’s far from reality.  There’s not a single project I know of that
> publishes the list of public keys authorized to sign its tarballs.  Even
> if they did, we’d need a way to authenticate that list.
>
I think <https://www.kernel.org/signature.html> has listed all their
public keys used to sign their releases. This seems to be quite a neat
way of doing things. But you're right that there is no easy way to
authenticate that list.