I think even this solution could go farther. Why isn't there a tool that automates all the checking of keys client side to check all this.
For example, when I download a binary or source package from some site with a corresponding file full of SHA1 or MD5 hashes, why isn't the presentation and serving of these keys sufficiently standardized that downloading the file can trigger and automatic download and hash comparison and then pop up a dialog that shows whether or not the file checked out ok. The process is so incredibly manual s that's very likely that most people will not check keys and signatures. The SHA1 or MD5 file could be completely standardized for the files served from the same URL folder root and have a standard recognized filename just like index.html or robots.text.
The system could first be designed to make it completely automated to check hashes and signatures. The next step would be to start building in layers and tools for the web of trust so you can also confirm that the signature your are accepting is also trustworthy. To get to a true web of trust, you need to slowly build up the foundational infrastructure for it, layer by layer.
For example, when I download a binary or source package from some site with a corresponding file full of SHA1 or MD5 hashes, why isn't the presentation and serving of these keys sufficiently standardized that downloading the file can trigger and automatic download and hash comparison and then pop up a dialog that shows whether or not the file checked out ok. The process is so incredibly manual s that's very likely that most people will not check keys and signatures. The SHA1 or MD5 file could be completely standardized for the files served from the same URL folder root and have a standard recognized filename just like index.html or robots.text.
The system could first be designed to make it completely automated to check hashes and signatures. The next step would be to start building in layers and tools for the web of trust so you can also confirm that the signature your are accepting is also trustworthy. To get to a true web of trust, you need to slowly build up the foundational infrastructure for it, layer by layer.