More sources/signers for satoshilabs signing key?

[uartp1cy]

What other sources are there to check the fingerprint of the satoshilabs signing key except for trezor(dot)io/learn/a/download-verify-trezor-suite-app ? Downloading the key and fingerprint from the same website/domain is not ideal. Are there other sources where the fingerprint is published?

Or what about other signers (web of trust)? Do you know of any other people/developers who signed this key?

[Petosiris]

@uartp1cy

Downloading the key and fingerprint from the same website/domain is not ideal.

Why is that?
I’d think that since they are located on the creator’s website they can be trusted. If I found the key on some other website I’d question myself if that key was genuine.

[uartp1cy]

@Petosiris

I’d think that since they are located on the creator’s website they can be trusted.

And how do you really know/verify you are connected to the actual satoshilabs servers? You trust the pre-installed root CAs in your browser??? Have you ever heard of SSL/TLS man-in-the-middle attacks?