@orionwl wonder if this would be a good time to try bip322 sigs for releases?
@ajtowns @orionwl Web-of-trust works for it's intended audience: people who are taking the time to actually verify something rather than just relying on their web browsers.
Re: multisig, just sticking a few different signatures on releases manually is fine. Anyone verifying this stuff to that level is verifying it manually anyway. And PGP *does* allow for multiple signatures on one file, even in things like git commits.
@ajtowns @orionwl BTW, re: "taking the time", I've consulted on the requirements for high-value storage. It's annoying, time consuming, work to do properly. Stuff like buying sealed laptops at in person stores randomly to verify install disks.
If you are doing it properly, verifying some web-of-trust is the least of your issues.
There are companies with wallets worth hundreds of millions of dollars. I've had clients with plans for billions (I seem to have dissuaded most of them...).
