Re: tl26 pretest start

Hi Norbert,

On Mon, Feb 23, 2026 at 09:31:37PM +0100, Norbert Preining wrote:
> Not convinced. Most users will not go extra to the TUG web site and
> check a cryptic 56 base64 key. I don't think this is easier / more
> accessible.

Of course.  I liked the idea that one can read such a key over a phone
call, which is definitely not possible with a gpg key! ;)

> OTOH, I don't know how many check anyway ...

IMHO, given the number of installations around the world, almost noone
does!

> > The idea behind signify is that of trust-path, instead of web of
> > trust.  That's why I came up with the idea that a TeX Live
> > distribution N could include N+2 keys.  No more.  The chain is
> 
> I like the idea - independent of signify and gpg. But as of now, we just
> extend the validity of the TeX Live signing key once a year.

A sensible choice.

> > obviously not as robust, I completely agree with you.  But it's much
> > simpler, so it's all about accurately assessing what is really lost in
> 
> What is simpler? I mean, from a user perspective? Users don't have to
> type in gpg commands, right? I do expect only very few to actually be
> able to verify say the installer package - independent from whether it
> is gpg or signify that signs the release.
> 
> So what would become simpler?

>From a user's perspective, indeed, it is transparent.

Actually, I just took the liberty to jump into the discussion because
it so happens that for the very modest TL for OpenBSD that I maintain,
I had just this morning abandoned gpg in favor of... signify!

And precisely because almost no one checks, gpg made installation very
complicated.  In fact, just by glancing at the diff, you can see that
it's much simpler with signify, even for myself!

https://git.sr.ht/~ralessi/texlive-openbsd/commit/bb05960

Nice discussion anyway, thank you.

Robert