Suppose I want to publish (or send to someone) a file. I also want the recipients of it to be able to verify that any further updates to it come from the same source/author as the original.
The obvious solution is to ship the original file with a public key and a GPG signature of the file. Any subsequent updates will be signed too.
However, the verifiers would have to import the public key into their local keyring.
Isn't there a more flexible, less obtrusive approach? Maybe not GPG but something else?
For example, something like this would be ideal:
toolname --verify --pub path/to/public.key --sig path/to/signature path/to/file-to-verify Looks like GPG can do it but only in 3 peculiar steps:
gpg --no-default-keyring --keyring ./temp-keyring.gpg --import pub.key gpg --no-default-keyring --keyring ./temp-keyring.gpg --verify signature.gpg path/to/file rm ./temp-keyring.gpg 
