Provide your PGP signing key promimently on the JSXC web-site / install instructions. about jsxc

[sualko]

You can find my key on the federated pgp keyservers (e.g. https://keyserver.ubuntu.com/), keybase, or on the release page of this application.

Adding the key in this repo, would make no sense, since an attacker could just replace it and I think I published it to any common pgp authority. If you have another one, please let me know.

[the-rocinante]

That's all well and good for someone who knows their way around github and uses it routinely, but it's definitely not obvious that you need to click the little green arrow and read a popup menu. Nor is it clear that there are specific keyservers to query apart from simply gpg --recv-key .... on it's own. While I appreciate the heads up, that information wasn't clear at the time it was needed. What would make sense is to make that information more clearly and readily available in a place your users will actually know to look, such as in the installation instructions on the JSXC website, or in the README.md of this github repo.

[sualko]

You can just use gpg --keyserver https://keyserver.ubuntu.com/ --search-keys [email protected] which is a quite common pattern to find keys. Nonetheless, have fun with JSXC.

[the-rocinante]

Klaus, I already got the key from your website before I submitted the feature request to start with. It simply took longer than was ideal given the importance of that detail in the context of a security product. So, I wasn't asking this for my own sake, but to encourage you to provide the information more prominently in the install instructions so that others wouldn't experience the same frustration I did in trying to verify their downloads. It literally would have taken you less time to update the HTML with that info than it did to equivocate in this ticket.

The above notwithstanding, I have JSXC already installed for some time now and am grateful for your work on the project.