<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><span style="font-size: small;" class="">Someone brought up the Apple code signing infrastructure. Yes, there is an issue there, yada, yada. And not just with Apple, it is a basic problem with signing any platform: How do you know the distribution is to be trusted?</span></blockquote>That was me, in the context of compelled actions by the provider.</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-size:small">Here is how: You use Certificate Transparency. </div><div class="gmail_default" style="font-size:small"><br class=""></div><div class="gmail_default" style="font-size:small">Only instead of enrolling certificates, you enroll signatures on code releases. And you establish an update process that ensures that code updates will only be retrieved if the signature is properly enrolled.</div></div></blockquote>No help at all. If the US government - or another government with the power to enforce it's desires - comes to Apple and ordera "build us a distribution with the following modifications, and sign it just as you would any other distribution", no technological measure can possibly help.</div><div><br class=""></div><div>Of course, in the US, that would lead to some interesting legal arguments; but that's a separate issue.</div><div><div> -- Jerry</div><div class=""><br class=""></div></div><br class=""></body></html>