CentOS

Sorry for late reply but I haven't got the notification. From users point of view GPG keys are not easily accessible. The chain of it is ' Download CentOS ' -> ' verify iso ' -> ' if you wish to verify (...) detailed instructions '. This seems very deep and convoluted path and I would assume 90% of ...

I noticed that by default mirrors use http links making MITM attacks possible. The only way to select https:// mirror is to check one by one. In addition all other files to verify download (checksums etc.) are available only by the same channel. Ideally small files (.torrent/checksums) would be serv...