Downloading Trezor Suite

General topics
#1

Hello, I have two problems:

  1. I read in the trezor.io website this : You should only trust downloads from our official website or GitHub page:
    2.Official website:* https://trezor.io/trezor-suite
    3.GitHub:* https://github.com/trezor/trezor-suite/releases But the trezor suite installer is downloaded from: https://objects.githubusercontent.com/ I should be absolutely sure I am downloading from the correct site and this does not looks ok.
  2. Also I can not verify the download: "the signature of this message is valid but untrusted” Thanks for your help.
#2

Hi @Bitcoiner65,

If you only need the latest publicly released version, download the desktop version from https://trezor.io/trezor-suite or use the web version at https://suite.trezor.io/web/.

#3

That’s a GPG thing. What it’s saying is:

  1. You gave me a public key…
  2. That public key does match the download.
  3. So whoever owns that public key actually did sign the package.
  4. However, I don’t know where you found the public key in the first place
  5. By default, I don’t trust it unless you explicitly tell me to.

See this: https://twitter.com/Trezor/status/1559547643260452865
Check that the key fingeprint matches. If yes, that’s your confirmation that this is OK.