Re:Signing .jars is not worth the effort
by vbezhenar on Sunday July 26, 2020 @06:06PM
(#23960549)
The best verification would be recorded video of a person with sheet of paper with printed hash, pronouncing this hash. Of course this video is supposed to be served by https. So if you have any idea about that person (e.g. you saw him at conference), you can confirm its identity.
It might be possible to edit video to change picture, to fake audio. But that's as much as one could do without personal contact.
It might be possible to edit video to change picture, to fake audio. But that's as much as one could do without personal contact.