What other sources are there to check the fingerprint of the satoshilabs signing key except for trezor(dot)io/learn/a/download-verify-trezor-suite-app ? Downloading the key and fingerprint from the same website/domain is not ideal. Are there other sources where the fingerprint is published?
Or what about other signers (web of trust)? Do you know of any other people/developers who signed this key?
Why is that?
I’d think that since they are located on the creator’s website they can be trusted. If I found the key on some other website I’d question myself if that key was genuine.
And how do you really know/verify you are connected to the actual satoshilabs servers? You trust the pre-installed root CAs in your browser??? Have you ever heard of SSL/TLS man-in-the-middle attacks?
I recently started wondering about this also. The correct thing for satoshilabs would be to have their key signed by a couple of independent parties that in turn have their keys signed to establish a web of trust. When I check their latest key it seems to be signed by Pavol Rusnák (91F3B339B9A02A3D), but on the keyservers I can only find an expired key (expired 2025-06-16, as checked 2026-07-13), and that key is not signed by any others. So that doesn’t give super confidence.