README.md: add other places to confirm keys

* web.archive.org
* project homepages
* similar projects/webpages (artemislena.eu, jonaharagon.com)
This commit is contained in:
Aminda Suomalainen 2021-06-10 16:25:30 +03:00
parent 2b72f9d247
commit d1f1b55dc1
Signed by: Mikaela
GPG Key ID: 99392F62BAE30723

View File

@ -40,6 +40,16 @@ control what people do with the signatures from this repository).
* `me/me.asc` is just my key and place where I try to keep all signatures it
has received. Symlinks are legacy reasons and other me's are also me.
## Places to check for keys
* GitHub, Gitea and GitLab expose user public keys when you append a `.gpg`
after their profile page (`.keys` for SSH).
* [The Internet Archive's Waybackmachine](https://web.archive.org/) is always
a good place too especially when using together with official websites.
* Some people have similar projects or webpages for this purpose
* [Artemis' verify page](https://artemislena.eu/services/verify.html)
* [Jonah Aragon's Third Party Public Keys page](https://jonaharagon.com/verify/)
## See also
* [Qubes OS: On Digital Signatures and Key Verification](https://www.qubes-os.org/security/verifying-signatures/)