Is it normal, that some companies just sign the txt file which contains the sha value of the program?

Scenario A: Suppose I have an .exe file, the provider offers a sha1 txt file with hash value and this txt file is gpg signed. So I check if the hash value matches the exe file and then download the key either from the keyserver or directly… Continue reading Is it normal, that some companies just sign the txt file which contains the sha value of the program?

Is it possible to create different "views" of the same GPG identity based on the audience?

I’ve been looking around the Internet as well as the various stackexchange posts on the subject and I’m still left wondering because most of the time the questions are from the perspective of the key’s owner; if, say, I have many authentic… Continue reading Is it possible to create different "views" of the same GPG identity based on the audience?

Is it possible to create different "views" of the same GPG identity based on the audience?

I’ve been looking around the Internet as well as the various stackexchange posts on the subject and I’m still left wondering because most of the time the questions are from the perspective of the key’s owner; if, say, I have many authentic… Continue reading Is it possible to create different "views" of the same GPG identity based on the audience?