Updated GPG Key for Signing Firefox and Thunderbird Releases (blog.mozilla.org)

If the signing subkey was committed, that implies developers have it as a file on their system which I find surprising if true. They should be using hardware like a Yubikey or something. Especially for something this important.

Isn't this the sort of thing TUF[1] was invented to combat ?

[1]https://theupdateframework.io/

I’m surprised that the signing key lives on a non-airgapped system. A sophisticated attacker won’t be leaving any traces.

It is insane that this key is not kept in a HSM.

It would be good if there way a way to attest that a key was generated on and bound to a specific HSM.

And this is why Microsoft requires signing keys to live in hardware for signing code.

Eeeesh. Mozilla, wake up to build and signing processes from 20 years ago, please. Don't embarrass yourselves like this.