http://www.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion/wiki/Software_Signature_Verification_Usability_Issues_and_Proposed_Solutions
See TUF Threat Model, TUF: Attacks and Weaknesses for further information. https://daniel.haxx.se/blog/2021/06/07/bye-bye-metalink-in-curl/ Subresource Integrity [ edit ] Would solve mirror issue. Unavailable for file downloads. https://github.com/w3c/webappsec-subresource-integrity/issues/68 OpenPGP Signed Website [ edit ] OpenPGP Signed Websites and browsers verifying website signatures do not exist yet either.