I wonder something every time I download Mullvad’s updated VPN client. ‘Verify this download with the GPG signature’, it tells me.
But surely if I’m in a position where I’ve poisoned Mullvad’s executable, I’m also in a position where I’ve doctored the GPG sig to match? That sig just being something that I download from mullvad.net.
Unless it’s somehow independently verified, I’m not sure that I see the point?
(Or anything else similar. Not picking on Mullvad, it’s just the one that comes to mind.)
But surely if I’m in a position where I’ve poisoned Mullvad’s executable, I’m also in a position where I’ve doctored the GPG sig to match? That sig just being something that I download from mullvad.net.
Unless it’s somehow independently verified, I’m not sure that I see the point?
(Or anything else similar. Not picking on Mullvad, it’s just the one that comes to mind.)