Re: [Gnu-arch-users] (fairly minor) SECURITY ISSUE

[Tom Lord]

    > From: Brian May <address@hidden>

    > Regardless of how you feel about multiple signatures, etc, I think
    > Colin's proposal for detached signatures is a good idea.

    > It means GPG will verify that the file contents are the same, and
    > there is no way somebody can insert extra data before or after the
    > real data.

    > Sure, you can add checks to make sure that there is no data before or
    > after the GPG signed data, but wouldn't it be a lot simpler, and more
    > flexible just to use detached signatures?

Simpler?  Hmmm.

No, it seems like a workaround for a fundamentally critical feature
missing from gpg (and one that would be simple to add, I hope).

-t