Re:Pypi.org is running a survey on the state of Python packa...
by jacques_chester on Wednesday September 07, 2022 @02:08PM
(#32754029)
> Then it doesn't matter if the domain expires and someone re-registers it, since they don't have the developer's private keys.
A principal reason to use sigstore is to get out of the business of handling private keys entirely. It turns a key management problem into an identity problem, the latter being much easier to solve at scale.
A principal reason to use sigstore is to get out of the business of handling private keys entirely. It turns a key management problem into an identity problem, the latter being much easier to solve at scale.