Updated GPG Key for Signing Firefox and Thunderbird Releases

csmantle 23 points 5 comments August 11, 2026
blog.mozilla.org · View on Hacker News

Discussion Highlights (1 comments)

noman-land

If the signing subkey was committed, that implies developers have it as a file on their system which I find surprising if true. They should be using hardware like a Yubikey or something. Especially for something this important.

Semantic search powered by Rivestack pgvector
4,128 stories · 37,281 chunks indexed