On Fri, Dec 11, 2015 at 11:58:17AM +0100, Thijs van Dijk wrote: > On 11 December 2015 at 05:51, Andy Bradford <amb-open...@bradfords.org> > wrote: > > > If one wants privacy on a website then more is required than just HTTPS. > > > > Right. *I* just want a reasonable (256-bit) guarantee that the signify keys > on my screen are the ones the OpenBSD authors intended me to see. > > I currently just assume they are correct because it'd be enormously complex > to spoof the entire OpenBSD distribution, but I souldn't have to rely on > "security through effort involved".
I would consider signify keys printed on CDs and copied across several web sites safer than trusting the hundreds of CA certs shipped with a standard web browser. Instead of verifying signify keys you'd now have to keep a copy of openbsd.org's SSL cert fingerprint and keep track of that as it changes. And it won't conventiently change in lock step with OpenBSD's release schedule like signify keys do.
