Security and Usability Issues of Clear Signed Checksum Files - Part 2

Project Discussion
,
3

Over in the older thread [1] , people object that it’s a hassle for gpg to import the appropriate fedora key and then verify the signature. Could that initial import be automated? Could Fedora offer a preinstalled keyring for gpg users? Or maybe drive the verification from another frontend that already knows/trusts the fedora keys, maybe rpm? Or a “fedora-gpg” wrapper that PGPHOME’s the fedora keyrings?

[1] Fedora verification process - #7 by vekruse