Re: Best practices for signature verifcation

[kf503bla () duck com]

then what do you suggest to use? i hear it all the time "pgp sucks" but what's the alternative huh?

> In light of the recent GnuPG vulnerabilities, I remembered that OpenPGP
> is almost never the right choice. CMS/PKCS#7 isn't any better, and
> X.509 is also bad except that its extremely wide deployment in TLS
> keeps it alive.
>
> See https://www.latacora/com/blog/2019/07/16/the-pgp-problem/
>
> and https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/.
>
> --
> Sincerely,
> Demi Marie Obenour (she/her/hers)