Christoph R. Murauer wrote: > True but let me be a littlebit paranoid. Would it not be possible to create a > new .fs / .iso with new keys in /etc/signify/* and new SHA256 / .sig files to > place bad content and distribute it using a torrent ? I came across this idea > as I readed long time ago some ideas how goverments could distribute the here > in Europe called trojan of the state (Staatstrojaner).
Don't verify with the key inside the thing you're veriyfing. There is some difficulty bootstrapping from nothing, but that's life. However once you have one trusted install, you can verify future installs regardless of source. signify wasn't developed for the express purpose of supporting torrents, but it was developed to reduce the need to trust mirrors. A torrent is just an untrusted mirror in that world.
