*** "Sean E. Russell" [2026-10-16 16:20]:
>Sergey, your PGP key in the public keystores does not include anything but your
>self-sign. You might want to refresh it, especially if you have a signature from
>Stallman.

Ooops, indeed everything is missing on two keyservers I checked.
According to https://keys.openpgp.org/about/faq/ third-party signatures
are not included by default because of spam. Indeed I remember that there
were serious issues with that. Well... that means that keyservers are
useless now for full public keys distribution. Completely forgot about that.

So the only option is to download it via WKD (which URL is included in
my mail headers): http://openpgpkey.stargrave.org/.well-known/openpgpkey/stargrave.org/hu/s8kd45yyt8ymu6uttefkjkngyagsui5x.asc
Actually WKD requires the use of HTTPS, but one suppose to have common
trust anchors in that world? In my opinion that was very short-sighted
decision.

>Sergey, I can't verify your tarball sig with openssh 10.6p1, which is what Arch
>users have. I get an unknown or unsupported key type. If your sigs require a newer
>ssh than that, they won't be useful for software distributed through AUR for now.

My bad, I forgot to re-sign all tarballs with the latest OpenSSH key,
which was updated 2026-10-09 from ssh-mldsa44-ed25519@openssh.com to
ssh-mldsa44-ed25519 algorithm. Currently it was not included in any
tarballs, as no releases were made since that time. Just reuploaded all
*.sig files. OpenSSH 10.6p1 is exactly the minimal version to check them.
That key can be got either from Git repository, or
http://www.goredo.stargrave.org/PUBKEY-SSH.pub
http://www.goredo.stargrave.org/PUBKEY-SSH.pub.asc
(as described on http://www.goredo.stargrave.org/Integrity.html)

-- 
 * Origin: Stargrave's homepage http://www.stargrave.org/