The average person using GPG isn’t actually providing me much evidence in that regard, given the number of ways to have technically used a GPG key to sign an artifact that aren’t secure.
replyThat's easy to handle: if the signature isn't secure, it doesn't count as an attestation. I have no problem with putting the onus on the person doing the signing to do it right. But at present doing it right on your own is not even an option. Only going through one of the tech giants is.
replyHow is PyPI supposed to tell if the person signing the artifacts is handling their key securely?
replyThey can't. But they can't tell for sure if large tech corporations are doing that either. Data breaches are a thing. Auditing Github workflows doesn't prevent them.
replyMicrosoft can't even figure out how to send email reliably. But sure everyone should trust them with signing packages.
reply