Re: TLS encrypted source for Debian iso signing keys?

[John Hasler <jhasler@newsguy.com>]

Rob writes:
> Basically you can use the debian-keyring package to obtain keys of
> many Debian developers.  You can have a high level of trust that those
> keys are real because the package is signed and apt-get would notify
> you if the signature was not real.  The iso you are downloading should
> be signed by someone in that keyring.

The problem with this is that it lacks an out-of-band channel.  A
sufficiently dedicated m-i-t-m could nobble everything.

Of course, if you downloaded your browser he could have nobbled the keys
in it too, so TLS does you no good unless you got your keys via a
channel you can be sure is not controlled by the m-i-t-m that causes you
not to trust the Debian keyring...

Perhaps you could pay Steve to burn a CDs for you and then have a bonded
courier service pick it up and deliver it to you.
-- 
John Hasler