Re: Impossibility of cryptographic verification of downloads

[arrowscript]

>Anything else, that has PGP keys and such.  Good luck!

It's curious you say this Theo, since OpenSSH already uses PGP to
sign the releases... no?  Web of Trust wouldn't minimize the
probablity of corrupted packages?  What makes you think that the
main server (openbsd.org) cannot not be pwned?  Just asking because
I don't really understand the crypto theory behind it all, but I
didn't read any elaborated argument besides a big "NO" from openbsd
community about use of TLS and PGP for packages.