Merge pull request lightningnetwork#5053 from guggero/verify-count

verify-install: add keys to repo, pin signatures to keys

.github/workflows/release.yaml

@@ -113,8 +113,7 @@ jobs:
             To verify the `lnd` and `lncli` binaries inside the docker images against the signed, reproducible release binaries, there is a verification script in the image that can be called (before starting the container for example):
 
             ```shell
-            $ docker pull lightninglabs/lnd:${{ env.RELEASE_VERSION }}
-            $ docker run --rm --entrypoint="" lightninglabs/lnd:${{ env.RELEASE_VERSION }} /verify-install.sh
+            $ docker run --rm --entrypoint="" lightninglabs/lnd:${{ env.RELEASE_VERSION }} /verify-install.sh ${{ env.RELEASE_VERSION }}
             $ OK=$?
             $ if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
             $ docker run lightninglabs/lnd [command-line options]

Dockerfile

@@ -44,6 +44,7 @@ RUN apk --no-cache add \
 COPY --from=builder /go/bin/lncli /bin/
 COPY --from=builder /go/bin/lnd /bin/
 COPY --from=builder /go/src/github.com/lightningnetwork/lnd/scripts/verify-install.sh /
+COPY --from=builder /go/src/github.com/lightningnetwork/lnd/scripts/keys/* /keys/
 
 # Store the SHA256 hash of the binaries that were just produced for later
 # verification.

docs/DOCKER.md

@@ -61,8 +61,7 @@ script in the image that can be called (before starting the container for
 example):
 
 ```shell
-⛰  docker pull lightninglabs/lnd:v0.12.0-beta
-⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.0-beta /verify-install.sh
+⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.1-beta /verify-install.sh v0.12.1-beta
 ⛰  OK=$?
 ⛰  if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
 ⛰  docker run lightninglabs/lnd [command-line options]

docs/release-notes/release-notes-0.14.0.md

@@ -142,6 +142,13 @@ documentation](../psbt.md#use-the-batchopenchannel-rpc-for-safe-batch-channel-fu
 
 ## Security 
 
+* The release signature verification script [was overhauled to fix some possible
+  attack vectors and user
+  errors](https://github.com/lightningnetwork/lnd/pull/5053). The public keys
+  used to verify the signatures against are no longer downloaded form Keybase
+  but instead are kept in the `lnd` git repository. This allows for a more
+  transparent way of keeping track of changes to the signing keys.
+
 ### Admin macaroon permissions
 
 The default file permissions of admin.macaroon were [changed from 0600 to

docs/release.md

@@ -99,8 +99,7 @@ script in the image that can be called (before starting the container for
 example):
 
 ```shell
-⛰  docker pull lightninglabs/lnd:v0.12.0-beta
-⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.0-beta /verify-install.sh
+⛰  docker run --rm --entrypoint="" lightninglabs/lnd:v0.12.1-beta /verify-install.sh v0.12.1-beta
 ⛰  OK=$?
 ⛰  if [ "$OK" -ne "0" ]; then echo "Verification failed!"; exit 1; done
 ⛰  docker run lightninglabs/lnd [command-line options]

scripts/keys/Crypt-iQ.asc

@@ -0,0 +1,31 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: GPGTools - https://gpgtools.org
+
+mQENBFzxMZ4BCAC5rjT2bbyqMNbHEVMs5Oi7y77eOHhwf1KRx5UALWoH1eDb6/kH
++ZnTUjL2h11aN+8cDJCCleFfARXxvxo97TSyz4V+VjHebKu3kulFtqLcgR2C4BeE
+oJqe17sE3+iJQt4+uirl1IEF/fe0DMtKbc55V5LIpvmB+s9U7RmGYNqCCmva48sj
+CmYhig885C55s/tUsCA/OQcxES4lZhcY7C/+LowvummXEOLeUUHnFyTJdX2QWBLg
+l0zXt98JiY9mZGoWQk9Syb3tkMLLL0YY7AZs1BmsNn2gBpPBTHkmMXxO2khX4mlB
+r6clRO7A1oci58D9/+f2GRzfLJjxoTCXqCs3ABEBAAG0J2V1Z2VuZSBzaWVnZWwg
+KDpEKSA8ZWx6ZWlnZWxAZ21haWwuY29tPokBVAQTAQoAPgIbAwULCQgHAgYVCgkI
+CwIEFgIDAQIeAQIXgBYhBH6B72uZianMk4hIAxGHWeg0OamxBQJfhf0tBQkGVzKP
+AAoJEBGHWeg0OamxyB8H/jwmQnlbxf1/q6C75W2/Mf+/0VH0A2q6pSN0aBvbDvHJ
+jNYp7uWynLHYFWrHHVSsMg3nzrubiNtjUy001+hVKcD4TB33b1YRl5XQk87OjHZl
+Kprj2351ypAjnxbsaYRIqu6Bvpfgj6TkR9xpZ+3rVRA7V1CfSyTJOTi1VzBNlO6m
+UsHh5dSlT3G6ESU31MbP4lp2H1XTik5uymCTSeCIn/TdqYQen9ZNxjJGkHjszUrw
+x4S4Rz/IylBVX1FffdqMJoD6RoOeScpyET4lHF1xi1xZkdgwx0etkmOW9O1dkhmg
+ysJnHNZlYeKklCf20fwhqVOxpaac0nqOZnILbMFj2lK5AQ0EXPExngEIAMA37Zv0
+SyIQLzRb7hF512aut6gveACkWAy1OktuSc8/GahP1pB1gtqBoS1S4Lv3uyujnh8j
+rqx/r5zoCEt2y6byf8qx/jQMZ/4IH+ZGlA6guNz871rjGIDO/6OE9O0n9v4PztDv
+ZTbqGTdwn4Vev62UUUTZJcYjIimgU5voz998tFvdOmReo5KlQfZnVEMI62xARssy
+9BQ0g7ncmm0RyjQMNwchIF9NfrJWk2JF3zRqVP1Aix41gflOomCKvij9spzAzRzA
+so4e67+NMpVzW9jfPG16AoBl9j16uHoYYlFkpkeNFDQV0BjTpJ6v571IDHJrAyDq
+x7Zf6DQruVs95CcAEQEAAYkBPAQYAQoAJgIbDBYhBH6B72uZianMk4hIAxGHWeg0
+OamxBQJfhf1DBQkGVzKlAAoJEBGHWeg0Oamxo9IIAII3/Ni18V2sDcNyUhuznJLl
+I9kAv8y10OGu13iOp1bifVDgnoZuEvX2Zhg+GqbbR6iWjWGDzQfxrmvV5YzDvDM9
+rjTaeFAX3EJbE28x/7ERLGHuhV4BVQYzmUGMiy0mjogZnefp4RyfNjR62qBWm8tU
+ap5ly7Phxkuup31BDxXKamr/+gGXCz3mfV2+Q73PqM7Nui9hR6rZbiO7JxEEWfpG
+01Oh0a65wVvNg804czcUqK7sHAKMzKunM/9JRx5hBJIXN8tl/1g2RpaKm96/lfVe
+6Z9yTNmRMIo6JCNnWbTPm3Qay134M59nDATb0ffPRCFW8SJeTRYrX1lnAv5Ew9M=
+=x0si
+-----END PGP PUBLIC KEY BLOCK-----

scripts/keys/README.md

@@ -0,0 +1,15 @@
+# Release verification keys
+
+This directory contains all keys that are currently signing `lnd` releases.
+
+The name of the file must match exactly the suffix that user is going to use
+when signing a release.
+For example, if the key is called `eugene_.asc` then that user must upload a
+signature file called `manifest-eugene_-v0.xx.yy-beta.sig`, otherwise the
+verification will fail. See [the release
+documentation](../../docs/release.md#signing-an-existing-manifest-file) for
+details on how to create the signature.
+
+In addition to adding the key file here as a `.asc` file the
+`scripts/verify-install.sh` file must also be updated with the key ID and the
+reference to the key file.

scripts/keys/arshbot.asc

@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFtrSrABEAC/2oPaUC8QuLjnCo74TBTwmcWMrcIsU0wzkHFpwouKbfg8Zwg3
+Hr2KbR/FkbkhDdco/gjgtXa40zcPz7XiP3RwPF3CZOmwey6RIQgIqa42uzr43wzq
+TbbDNfto3LnJpOzhdYFziVEY0JHQzBdd6mHw1VfEC86x2j3Vx1kEgVucp/LeHXai
+OF1NjFiuQuFzpF63Tah65s5Dw7w+u3/AkBYpXWHi1nhn48aI85e/2gek+7ALUhFh
+Z1kh8jHSKz760vHGUeprqASOD2fgLeg8p649Gr8Y9u7vu1YlbXPPu/bZN1phS6qQ
+lwzBcJRjGwFTgIiuv+Anay+EktH/6RYxLNMv6GuCmL3UINRTwUuaCc6RdCIoe/ZG
+U9v9Tgb6L3itMZixNDMqxiJu+rzmsL8Q+FzaAUiyca4AtA6GHQJqjMKLjW82wt55
+3C5YdeksH3cv+j2KJ2hi3q6TcxsLZp7cxLemcn8EsJ4rp/qgRCO0zK4IGbzZtLt0
+TP319Z4/gbmRdWUINrOicvxnC8Lq4kptNlpHNJMRdDCxEV1k0+aRV+kdHhPRgyYS
+dYCIJb9G9pok5DmLnjvFnbJswLXEYt8XyKVOeG0EMHh/AbnQC0nR/D/du3zDCg/7
+ZytGiZMRuXWU2Rwsvvc/bhB/QpfTtpGBQC6FyI51uVvqxnaHhvti8Er+nQARAQAB
+tCJIYXJzaGEgR29saSA8aGFyc2hhZ29saUBnbWFpbC5jb20+iQJUBBMBCAA+FiEE
+6Xoatsd6HSty9QpvkOAMyxx0xhEFAltrSrACGwMFCQeGH4AFCwkIBwIGFQoJCAsC
+BBYCAwECHgECF4AACgkQkOAMyxx0xhH9ehAAtPpawrRtWoa1W0laJHiQtiPCGQoK
+Q454iMUSsIuf94deqUpC+447e6Jg3bIscxMheIvk5t51J2FnfZYwWD4Qlqrr2TbV
+rcp8pXCZy7pBQ3N0swLarRRtK2LhXduqzms44HyX20lGRaeqYe5Okwfr1tO1pMFM
+yvgV+2Liiu+yY0OKEID/bAfjtHy0nfiahYl01IllKN96yAyCSrK7VJanTkEDnclK
+UONHP4UMLs/aU7SZVScOYJTZWZJLSKUFcpH+Jsp1FILIZRWXZ2JM9xsfktGs3roa
+4jVAA1ngv7lCxsOrVFIdBHNmq68jEp8pUCQWyu5q41nz5oTKiBJVGkKNIgN/Rb50
+6orPemILYJbj+qfUCnm/aw6EaLp3k64pdT3KqBmzR/Zxxdagybr3GB3N4RYez2fX
+wlukkqqu1KVM1AHlRvOLk5jjYpx0q4gbhPRbmnEWlHRH8CVIIWKYbe+DxYhyY2BZ
+ZQCzQBOk/ZcuS+HeJXQb77XJ+rrYfOBmXR9EtndPkGBUM5Dfb0YPjDsgC+wE6cR6
+o5gimKhJdAn+FFyZyMPcNLqIh19gdWg6F1c6gqEs6XPYJlexI4P42B1FD2rzdnKt
+/z+uZnlX5Ay0aEfxqM5Z2iG+5XF+xEoaR9f3SvJ2C0QKHor6DRfc10adygtVjfZ3
+ONv7J6FsqKCEcUa5Ag0EW2tKsAEQANwSr6Y0Wz0eggbxWjpV0hJ2nRGd3IUxWUO+
+7MYIdxKiKUTVkuwaKxZmAQ4ggQM7XLgRO7sg0URJK9uK4RUY4BVOx80TTL/bHmM3
+aEzbHv6hVSfgRZWr97totaMt8iZZ5tcpASKS1io+Snn4yCStU3eAyw+uuYiAkByo
+zbLPUrZvAKoDsdKToLv8NxULrw/fZBHAVMtEPsaxYa/T3e4Wu5hlxcIV5/2CixEJ
+VEgKfhzQMEhre0eYINdfVxX6iqPNcWdb8UedldtuZbNRAY+V4CiIaZJo8gB/7/CZ
+Y2XybjMvUizEIvCePkhbNV5JJKPaV1NdfgV61cEiu+XkJNXq5RFMqpEVwGQLlkLh
+G8szAaKV4rcDQLlQq0uinVkDbFCih16uk2ikxnHYQC3MIykU0PT8vqx5PCuaS7P8
+q0/SVwFAW2pZROkyGQ9w/Bskrxar6mX6tRg1jvx5ZMUJd5aJ4iBuWUbu9qRRDRDr
+FPzPjX0XjBgkf8UoPoprYEv9Ur8YVPU7Gw+3saUPhqiRDTg+EZTxQGqmcn2dIAZ4
+dTou5vvNonoRd0a7Zo8ZM6uFg4w+gHLw45GdsDUvtffe9o6TR0DoJWVF/2hgrjhv
+mLqws2gjVdJYlmOci3ZvkrZatcEHb8aqt90TGY2nHYzW8C2Tqz5a6DOQxXEkUC5l
++Xx+mDf/ABEBAAGJAjwEGAEIACYWIQTpehq2x3odK3L1Cm+Q4AzLHHTGEQUCW2tK
+sAIbDAUJB4YfgAAKCRCQ4AzLHHTGEcu5D/91/EP3roxIyDTj7+BUFKBOxRUfL93n
+wQ9c68q+UonWaLf5fXO4mLrPb+Vbkf9iGDEtiWrKKCDrDUmHF0W0mj+Y75bN65fo
++r8XNdgT+RMnk+80DRsAyYcpdVM5dWuGkrJ1jBaQXOAufSe1M0BsX18R1TlhoeRv
+tOW1yGxoCBHv5skbeJDXjzJA/5nafrLMqSPNtTB14PBTPTDHPfVEICK/iOdAoMwb
+wZMebyzY8rqBiRuaGUhvTjDTRO58pjJ3SktjmTCDo8ybnAOZm010evO8nYe66Zd+
+ZcDc2LwBlCcSQ+8Gddk6YMMJYMYGnnG4ZTG8a/YkcGBkXdaX/rb5TGCyrxZn/zlj
+SHIMfdymlpA8Zhg7DGkRE2OedX9CyB8XwpdqoEECNYWGxHV+P6euYlmQXkmlfPFA
++RAryjXcmlCIcrebam8ZhgKEG5CTtHfTSMsmX8lIPVIw2UWFygU3vfakS5Mv5f1o
+UWkqWx6tsUpBspNrrPvGB4rgCk8HYV8htY7kG3QiusrFN0FzU38XfmC/26Utk9Gc
+i/8K47WiriQqAGgQNl/dOZgVazZJBcLHZxk5VDAP0y/PRhu5azX40cQoR0euyq/5
++7t81C3MSEWuFFo37VRkrV/vF50ZebXs39onAnJBxX5FMhEOl+BqQ0LsYQIaNSCX
+tS+lWBS+3CAU3A==
+=qhXJ
+-----END PGP PUBLIC KEY BLOCK-----

scripts/keys/bhandras.asc

@@ -0,0 +1,41 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBF7Y/fYBDADFf6INYvrBzeqwuPKUJysSRgrHo/LrQJW7dSryd+jFgtGuHLtl
+B/s6N1ZpD1aVvgyW5yY7SJRAsyLRUKJjxm97ZDf5ApnCzkTZQBx2cm0nfrGnSub7
+kCEleTsPA/+T8s9Fk3SVfBTZ4I3CNJamsh0wsmwxIfyf5GaaXs+nvRgwD5MF1sWi
+NrtsZs3bHxgfXwkqeVZ2Ny/WWJFXJWfEDmuwZMRsfVjSfTP4qNFgXAt+Ndmv9O1T
+2ufqpeOEhitTEHziwUO27oqLO+U5M1+McJy2lGN26wasywslY8YH9wdQ4MpEBeam
+S2lb/NIaunF3fXpHYCDGJ1/IXnDG2ocXmILaoJ9pER/cwLVDqN3eUNysxbCTaZfQ
+EI31j/89ZSUZaQK9kM8fP8PpLx6wgcvvc/OuN67htpWelO1wyQuehEj6pC3LRzap
+tugM080dm0m1TxnsSWtu0zTjrpqKgba+Vj6zDsCeeMAP7IUlATtny01kZNxyKX8/
+6lMevLvgIUVqzAsAEQEAAbQpQW5kcmFzIEJhbmtpLUhvcnZhdGggPGJoYW5kcmFz
+QGdtYWlsLmNvbT6JAdQEEwEKAD4WIQSfxrC/1ZepTb8JcIKA5TdcCUGY2AUCXtj9
+9gIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCA5TdcCUGY2Le5
+C/sHyK12jwqBNBZ6VVoaHMJ2JtrYqO4dS0E2I7pOeMkZrmfrX5K9bPyr7qmm7gH3
++OhMvnkUUGcF/jGDXPZshm5KhdTVPdqK9ctnp7tbIfSmEI2qkSi4ZhhQbdNqJ082
++ib3F5dHQa8ft937N/lklTibih2IQY/baGxOFH4LKNORTnMzUBjHVh++MfLTUSL8
+wSkbmEiPxppaS5lqnkOZkxTTxCXn07D3GbdTxsG4ttjxGvKCOQ0bkxZeLUcSbG0u
+yrQ/qxcy3NxnYl7VCCJpiQWNr73xrQesqeydYy5V4C7tHiUlap9whRDrbV4A4oEQ
+I0SMHjiPK99rLeV6LFKGe088myvHus3T0F5nGPaGoME9ZSSXLQpXQZRA6upVar44
+TNFj8DhFeAV3lNGzDyWDMcYe1Of5YSZG635C3EWh35yzJSmNoDJMPKOMrbAx2dCv
+jmxqY6WwE6/5WcdzfcvfgVm8CuDaNOw2SQXbyZiVrtVkxj3t7ymO7SlFtdbv+qte
+oTm5AY0EXtj99gEMAKh2EcoPM47Oq2QMsMHjZuuiBHrGS9KKdWQTVLhExIHth5lR
+FO5W8TH1cbp61URrP1sr5wXqQ7NpOwkxqKW4lvbhBpYK68FWAa5jfch8Z4iUNAfb
+dmH16WySw37tq/EV6BU1AFR4M6neAvcAq7QFiGU7RTY+OzHBSZ1gLZ2GaSaOCp+o
+f8qgsvOKClgKXT+zbHA6f9iyPj2LB8W1kOTQUhHB10VPK0nwGkU/QxNoZFXs311Y
+aSlDHb8Qqz4Kd308MUMoHVh2+PGICaxFiNZx9LNK/bk7/lkv08sAgeIpK1EYhPg8
+wQTECjO23tL1rqojSc46JBKxkqdzihEXElJ4eKOUmSbGFwkYgWM1nKUS4fm+nyjq
+kag4ehKNcfcoEg5Wpgcz/xLQE1S1WBmPhLNlNOYgcp0DY/OMOvetM5+aggHD4XKb
+YFfjt6BWXmdVyPSNc0OZ+FTgs68FQ9ZnICke8lxmdKKEmsNQsb+B3j+LSSaW3SX1
+xBTqlAI3cQwX9sp4nwARAQABiQG8BBgBCgAmFiEEn8awv9WXqU2/CXCCgOU3XAlB
+mNgFAl7Y/fYCGwwFCQPCZwAACgkQgOU3XAlBmNgKGAwAqer3Uy8AXYrzzbjOm64X
+yXvug0gceiqHsL0poMqtbLbjO99XJcxbCDI6Cm1TOhJHSi3boFWK4gGb3INB8QpW
+pDSHtkM9HmIF5FBDF8R91mchAPwFcPP8pZjgz1JSLVOlawVzqzxrUoVDmHGRhdmo
+WcO/0i4f9/2hjgz8Os4nRyv8syN5rQPOw6y0gyAjxITUVNF1zwPQwTLdhpaSgROj
+xKi8TL7osg+P+GfvTN4vMrwu3TT0e1s9OB94COqVQyZWGkQ5RtqsglqNNN5WOhNF
+bR7bsHxg0A4V7Rb8LL1n6sO2pnad52N+sAsNdz8EeESW9Hu27lVi685LMlQsPUJw
+B3uA9/SpWxnOwH06Si7ikm6lGOgEWrLC4yOPSgGFQWykabGbs0GLEFve7xkPKrd7
+ummRCNLFt9ZH+SneFUuQI4V79Y1NJDHkSqBeo6vHrsCt5WYCOCHJCTDkj03Ol3Kx
+NA0Yoa90avecgzIm3gL8WGXApTfVO2cojSMzUx7WCwHn
+=EosS
+-----END PGP PUBLIC KEY BLOCK-----

scripts/keys/carlaKC.asc

@@ -0,0 +1,66 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Comment: https://keybase.io/carlakirkcohen
+Version: Keybase Go 1.0.47 (darwin)
+
+xsFNBFryxCABEADqbpAH/1jJPJCAQtu9SD482x8aslY2YIHjrItEZQC8ZTvripNs
+IuyxMDhGr7/cBsiZdSH6BtVEAJkz6CGEe7j+VfxVPl7kUaKaLuWLqDbtZKlc5FdM
+j3GTM68PAjpGnLVIHKXgO9VRWXcew0QpijLwSUD9qBTrZa+OSblNI3y+uwjU+9f2
+jD6SA8ufqzGkiVey0nIEwSmjpkB8o6DlTG5LQlFqUjTz/tneVHxYI88ApAEfjmDF
+RHeDLky/10SeL0xrUhAiiYfCLitxpJ324+QZ0duAvECDy4LYeKDUGINNE+7yoLVk
+t/H/ban8WAr25R1zAPHT7rpiKYirbA8oiCeXJE57m1us0xTkMLjhC84Kq6wRDcec
+TI/1NQlsw857R7dapPK+CT49RKNDsVOnChJV2h9Era3dmuryRg7JB+wd8ptm6vIA
+WxqqasejyMakLYFLTqVH1H2yy1IOufRMUXTxQmENTEOccNM7q0W2UHaerKrYMrqn
+3xQgZIxklITMbdTCInGNNQlyuINcmbKqAuJIMuOqjg0RdmC4vvFI2Hkce6CMYZ0o
+XmGmh6M52cCk1EgsKwPf81POZ3mBiztv7BzWf6gXvCitHU2eIgOR+91/mEO3UOuY
+y1rNcyt9Am1s2GfWtCmgCPvFGz8kwJXriREBn3wuQhWH/CRPvV77BHtmiwARAQAB
+zSVjYXJsYWtpcmtjb2hlbiA8a2lya2NvaGVuY0BnbWFpbC5jb20+wsF1BBMBCAAp
+BQJa8sQgCRBMp/5UpiE8kQIbAwUJHhM4AAQLBwkDBRUICgIDBBYAAQIAAMCZEADb
+6EQm3u7jMKelsXTZefUGn3WyMmaqXZHv01Pd7XwaVz8sAKzrld8PZB5VOgbBVAcU
+y8CfNRfykOSC39nfDb1NhXmkwrrX0lBBDTNezXnXwNWLWiqyL/4VAc4AtvVtbxKi
+9W86dpkkdf4en1jZholvCuGe/4JJdkLFM3g/Hp2GS5bgeavdLQUUQqt+qUQiAtD3
+C6D7CrGDHt1SADVWTFEULsLO2F7kmfKlzyTMPV5MD//mrxODf9Zkyi+Bb25dnJVV
+LCn8JeBdiXWtxcOTEseKzeDv5Akqs1bzI7zxMj7PTT/LeUb/qQqw45GVyayuURji
+IREF+dQiHGB251oPT8St5AP7100g7G/vLGiae/TpQTkrqHENjQxJU0tTcxY3qu7h
+XAoemNoT/ripsyZi4u24qynXajXSkGN3Qwz5t2d8Q2hn8JLcAima3LA+xcCWA4FL
+K8lRkUaPCXu0oh5xtbq3hrTrhtUv3KFUSPlBJSX6iRyrt5MWVqAdzrfp9VMYSj3V
+h4mDiP1uZTmnPfzZA7IvOOH9MmHVUeQ2z4rfYe+dyLBGFbzoNTTwEILhrNM18gAP
+f1SVgYprezluLPe0l/IJAf0ZS+AlLC/dARGZVB1Ez+HRbfzO69PQNcr8VQS+05uU
+ZhH8CPv5Q9onP0LiyJlE8DWP2a8v/uXAnooqt3ZBys0fY2FybGFraXJrY29oZW4g
+PGNhcmxhQGx1bm8uY29tPsLBeAQTAQgALAUCWvLEIAkQTKf+VKYhPJECGwMFCR4T
+OAACGQEECwcJAwUVCAoCAwQWAAECAACmKxAAeZHqvXkUP0A68FWpBAW+lUZhUtao
+3eizZYwwvQLkk18PJJdchmNpz/oAC6PyVr7J9V/qeWgr03wzCX0ZzlDe4pLcgAXn
+9mEtAQOsKhQFgZ1nr+6qmVLyh85CTWp07rUoY26EAKb3vfRfnnb27BjkhcjoJ7mZ
+bLQ+b2bgAtIPOjSV3gUyPrB+iYNqd3ow4GV2qlnvk/Lqd0dnIvO3lt0fZN7b0EaQ
+OfG5xdwVTI4s1EdXz8/rVhNkSnxbfDW6ERCcBpEhWPN7y/SKh3x9SBwEqCr7g3lL
+GqP8/OodW6cDOO6+jjVetzaqIrAVL2P4N/hV5DBvnZlcsRPSLgwgiJr72rcL6j7g
+uqI+PsO/upgvUzQGp8KVbgXFPQ/5dMktCOr+E/EZMeOwnpxsRorS5cEoi6cuDh2v
+OqFF1Z7Kk3Z5/XxBak+4OTp5SH+oRXil0H1/H5nTzepAelcLpIQZAuJD31ycnLYF
+TwGo9+BzUcA+4MCIB5O23uLf580l6SrUM2ByEFAcodDxSGFtOrGhiO68TyIZ1yhW
+VoX2Px+9fgZYqMcfutkF04VSQR3IteQAH2Mq+lJzq0f2/MVLvYdWpLWY4jcmmMep
+IEnAe9z78bH3+IHkW4QcAITNMfsiEUfOVljSyKHsYgJm1+TIn5hMnZFZhurp7Bv0
+o5LINOpLib4kvLTOwU0EWvLEIAEQAMs4Vcu++TJXPnkH+xgD/d/YiRldnrlDBlkD
+Rpnpv53k1/ux9eT+7PhfJN/iEpsiKVIQDXfJ5NZ/EUwHU6Oz7om7fJT8vUGQ1elm
+AvbQfHtfmybHmZQ5pEl0rUrheU9GcC+3s+P9YnAjD1m2K5ZKC2yG4N0BL+jVrb0P
+p3jS81v0EOpsgqHFsAW6nbWwn09e6ZaZNJ4Itg84cyOLcGgaESMxgkL9WYeO5QKk
+Mex4GdOkdxWkdwsIKBhagbGnGDVQA2BAT2j6UxjIyXDqjPT/Bjx4dnLAHCCw5ufP
+CQzQPs9rMIP5rJmqw4TpK73f5MTslXZA0PKZvc+hiJb/+hBB/wGoXw/R/tjKmMMR
+MdvtZDm+WUSQMFqFCBN/sTYr2lb9xYj+8QUi/uEZhf0D99XoT3UkIIr+PpFDMavk
+tTvFuOQBOaS15yvd7s93TKIk01EyIvmTwg7fwbG2ChToIefFeEVv7wYpQ8x3tVVy
+d3qT/YgDhPIVZ3vzJjLd8ZRYnal0ts01w8ZtZgZ0r5rf6EQzHGxzZHHFUEaJLPAI
+L/YjVgZ2rOQ9AqcQkLvTKg+QB5Lm2mNUjRCOL91+9zYY++59uGhZ8Ql/b+QqkVNz
+vARY5XrAht95buISbnABhxYn0x5Mg/uQyMAQRT05u7DPS1eXZCa37i7kS1XaULT1
+yc6vuZTvABEBAAHCwXUEGAEIACkFAlryxCAJEEyn/lSmITyRAhsMBQkeEzgABAsH
+CQMFFQgKAgMEFgABAgAAH5YQAF17TY9M/8rkqo96liFWvPH/KPkvC70opryg32tV
+x4hn0RYBEf5O8sYcvuwHUBmBwmuNkucHzlvA5NB9CWXjnghGWq9w7x9yVZvo9nPU
+/r0CseMEMuHnsXFxlMbgbE7GCuGmsqrPGfK3vIVoqpZiNadBgtxcVHzNq8nn1i/v
+7BNhJRy14+XURZ8KfnfDnmiZDJayzu9bgGtEunGNs9FTgoj6ZEGqlTW9Y8BCtneU
+VYsrPA0BYhu9cvQEcIsp2/kMBFdMP40MdXXvmWAipDn8mW4tGb7gGSuOWudYmj9v
+BarwcTpQqimgPLPS6J4nqMvDxq+Ev6SM2L39SBnwXwGeOZiAJhTcgpdPy1Vs87qg
+taeLTc0f7DANV+n34mZvoIpBVtw5CHDWGOdi2zfmpsfirnVPeTG6aCLe1dYTF3Js
+O2WdJNcxX5Uz3K2hmmhe14dbEAY62Lk79IYKohiPk0i7N3Ob7IjskV0l8LsFhCe1
+vWMwPl+GkPatt1D3ygJTTD0hSboEMbXcR04vpwIaw2BO2flQcZPIqgEmJD4MRaE6
+aNhg7361SEv1IuwGqwskDvQHQ0Vlw1dA4qlSI4Xr+h17ceCg/mw68vlHD3bOWx1z
+9Pewp/yg5C9T/upkk+F7ulqtc5aFd+Qs8zK+ubdUQk6+Si1Jnahk8bJ9wKk/bxS5
+8mNq
+=2000
+-----END PGP PUBLIC KEY BLOCK-----

scripts/keys/cfromknecht.asc

@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFqe/pgBEADGITCXMdzn7+o0rpm4FTJu+LbPSPH+vZi5lbh8vHJ4R0KOMqhx
+zMcTLpcD962rmWD8aPq77iX91YXr+yqfpaI6Is2w8ZPjwUFP+Q541XN2djDhNFfu
+kPxI4PdMqIuDjPPbS4GIZiRHdCVgzzyvpJTBwBGEZJ204TmNoLWZ9zCh0AzpsJxr
+y4RHy+o6Gy4un1n2pu8tkCmaiEtzmRO+ahmNVHNeYUgUT4nDEMAU3VrkmNMctlxJ
+5Ng8k1BZ9foQrsjZg7Ovrhi+/L7YWP73TmY4jWxM+P52UyKyPOJiTqg+Xe/1aGPR
+ij1KJYoRqWNBG8euIQzcDt4uExndJ5SJtidF/8leCpQGmxDSYDcsAv3/93z/JGGz
+Q50j4dwDc11hzPJ9PBq1MLaGEYpQgJpgLx7uXAgu5eRZpFYseFmulbSDwdft78wS
+I6K4+9xvzG1LAx9AOomwXj5/I8tL8Cc+IusG6fQOGmHeQO8ekFTYBj9BU0vTLn6F
+8/5Bky+zSjx+IRgLpacSjkQGHruDF7JZN1bbAjEGhmMwW0jGzs9JC+HW89w0Yq9G
+sFjhyQEoMF9eWMVuhN9BxQ7DXAjXzuCl2MamwC0Aedv/qxExfRlbB0JrIPwl2w7B
+37e/26BBlUCrke4yhk0kNHbj6PiLd4Fuv3Bn20nLw4TBaHjqxn4knhnpmQARAQAB
+tDBDb25uZXIgRnJvbWtuZWNodCA8Y29ubmVyQGxpZ2h0bmluZy5lbmdpbmVlcmlu
+Zz6JAlQEEwEIAD4CGwMFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQScjWGGinxJ
+IAOydE7n1ze2f6WSxwUCYEPADgUJB4X09gAKCRDn1ze2f6WSx4dbD/94A8wo2aum
+e7n5I6lj5OIp/fwGOFuT+6lizZtewPuFMHv8qo0D7Gx02YHglB47o/LmVptSavX8
+BXqVhA0ZopAP81vtvN/VYyax8Lo9VrnrVQ1nLPP1XOVeFDm7IxFUsmFE7AAEkJlv
+cL1mmquxWfg40o6qxehoHy7mKqWI2ns1MaLFLJEdz38PVgGOrVjRR0o5vq2wBC2Q
+PoaxdFKbcycnhLx1Kqq9a69GOt21EKg2JBOgwvhv/ejYzg0gH/OU9vvG82vIAA0b
+Xee/nGrRSpsQmzfYl6g/TdmbCzjdv5ZK5+A0VnJvGIqEcuy8XhZZJ6jN9sM8YYAs
+f4oDRaEOcqldD+jmNwCb88Jxt+L12k+2a9H3ww74WlbQ2SxDLwkG9LhklIA4Op1i
+//LxTQ2kBZM747SE4UFvQYIQHvBgHD1zKvcXn5H9dk5diinAXCsULocEQ5xGIJro
+AN4QOlJcF7Po/KcSgKmYHL5FCNW2lUJ1VmG3AWydErkbidFiKtPJmWJFeXxDxal9
+/a3vt5UBSaKyoHC1oWIhfljRkV4QONFr0viEKb+4QAJzYaDZ8HRjLaS00OjUWaIb
+Bj/qoU+FUGxBLUaTBSoEDDJL26DezHP6J/cvlgmxi0lRiFkHKmTmtoNJEj/cxa7N
+YDDsy2bknvVzhs8wPg+9lm00V8Niy8oNubkCDQRanv6YARAA3we2me6D9FmKwv2w
+GmsoJUBoaX1E9gO/YKEyQT8638UMMjJIPH0uVovDk6OGNhykPP9Z2MGDZJNFxBh2
+dabxL/6QJLjYebseRurN8ruDewWhI0op3z0JkKvvUKNJeCLGQEqkbnpKDZ1SaIai
+2rDlytsrSo37KFp+sd2+WSJUgk5nzjSA1d1CCPPUQVqWsez8cDuir4TdAANyWsne
+XvxmTdnZAHpWFPjnjkypzBH7GIAudo7Gj0SGSPmkpmA2WZcw7vIYm2O1dUxfMVXQ
+7+znEkckZkdGLcmABOgTAkm7GseCTvnfnt0+TNgKTUKXGKe08nRAbqgysnwFDyG2
+lCey1Ntsz+D3mZfrAa0M9tIQZnjUOLmfr5q2UPjeOJFFGqkpeTb62JLsZpobvoOm
+gNmzGKr/djvihqVQM/bNIYE3OIrt+JOaB6Kb/bH4qgDd70TEXkX8efsmQtzcVT+9
+KLHyVvBjIQuoXqn84k26U5WQSEg889iA3eZ4rFvQrB4LZk0ryHC+bcroEEmU/LLD
+zZEXyAfCes0lzg9ZIh+3LSqnvD/dIeaVgfaV5AThfKtOwpO8NZF/TkGaXfwC+S8R
+/joyAWYJyIKs2ibu42CB+wnrJyb4ujJznCuzY5rW+1CC5+FlfYOaiWNovT9NU9S+
+jLprWDW1CydtfDdbjF9gjyQj0iUAEQEAAYkCPAQYAQgAJgIbDBYhBJyNYYaKfEkg
+A7J0TufXN7Z/pZLHBQJeYdPFBQkFpAitAAoJEOfXN7Z/pZLHOCsP/jgEJXk8mZW8
++d5shUWe3Hx10JiVPBymoDnv3NtJ8a9LGaJcsbKIjpzysMeZ5cW04l33NM+eaWb4
+/ogX98yak4JNYpaiDuloDyNAM7SqH1WdNMqVj3WXvH8Gw/azhDy7xudOGFQi6nTB
+14LsgK7X2zAVmxTu9kdwYh64APF2X48WqFQKd85gX35V5OFPGQbpI7viMFC9Sq7U
+E27VsyzNpt6hLfb1enEm3t8E6Fi7z5uxPhoX13FShm1ho6U3hQzc27JH08MWxxOE
+w8mcwg5l7ktpQOzUkFHvaPNKKAEQGZ4miOuZFajDWdz3eDe5bRrUYo1h6NR5Unv9
+9ZgCfmVuuHYfw+uwEiQcXb4F6UXHwjp8iJtFM4AOcG93nD+1ZkX6U6pneSF5O3cf
+EiEKQBu7MxiyWm7L1V+asR2uPWs9mXl1TNC2rlsHKCFJ8We0Xb1btfmlpTeINjPx
+yrERZmWUl5bY+sziSfX0H07v49jgPxUilBMxQaqrw0pOhzodq+R+R1OJX9aV7gfz
+KWov0Rq2/2TGoeIlVz0Y/mMDCz5ONRn21l1I+HBqjeEBFws8w41cQsKFl5+5dk4m
+LZ+g6JVoJ8rlqbMKS2TwhXHwC7ZCWn6w1WI74nJAkn+ULTXFUSwrsJrvwVVqY5YE
+P9FcOPI4UCyAsnvRuobOOGZjkARfXg/5
+=OCU6
+-----END PGP PUBLIC KEY BLOCK-----