On 2024-11-22 (Fri) 22:25:58+09:00, bawolff bawolff+wn@gmail.com wrote:
Essentially they are just some metadata signed with a public key. The idea is that the owner of the public key is responsible for verifying everything is true. But we allow randoms to upload files so i don't think it makes sense for us to sign these things.
Or even more so given that you have to pay a bunch of money to CAs. (because LE doesn't issue certs required for this stuff — S/MIME or 'Document Signing' certificates)
In theory WMF has the resource to buy the certificate, but IMO that would be a gross waste of donor money. (Or if they demand each user purchase the certificate, that might quickly go useless for our use case. I didn't read the docs beyond the 'you need to purchase' part.)