Hello! Can I remove an already existing Brave signing key from the /etc/apt/trusted.gpg.d? Without doing this, there’s no added security benefit. Any third-party (unofficial) repository which has its signing key added to /etc/apt/trusted.gpg or /etc/apt/trusted.gpg.d can replace any package on the system. Even if we assume none of the repo owners are malicious, an attacker might compromise a repo, which has the same end result.
If you do that, wouldn’t signature checks fail on updated packages from the Brave repo?
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.