Short update: I was just told that a similar problem has actually occurred with TPO infrastructure, back in February: https://lists.torproject.org/pipermail/tor-project/2019-February/002194.html The affected key, at that time, was the deb.torproject.org signing key, which was signed by a key with a large UID. It's a different attack, but that can be mitigated in similar ways. The good key is still available here: https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc ... where signatures are also provided so that you do not have to use the key from the keyservers. The key is also available on keys.openpgp.org. A. -- Antoine Beaupré torproject.org system administration
Attachment:
signature.asc
Description: PGP signature
_______________________________________________ tor-project mailing list tor-project@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-project