Summary
The repo commits one public key to pgp/pubkeys/ — benma.asc — but the macOS release artifacts are signed by a different key ("ShiftCrypto Security", DD09E41309750EBFAE0DEF63509249B068D215AE) that isn't committed anywhere in the repo. A user following the natural workflow — import the repo's committed key, then gpg --verify the download — hits No public key and has to go find the real signer on a third-party keyserver. I'd like to propose committing the actual release-signing key to pgp/pubkeys/ so the key that signs the binaries inherits the same version-controlled trust as the source.
Steps to reproduce (BitBoxApp 4.51.3, macOS DMG)
# Import the only key the repo publishes:
curl -sSLO https://raw.githubusercontent.com/BitBoxSwiss/bitbox-wallet-app/master/pgp/pubkeys/benma.asc
gpg --import benma.asc
# Download the release + its detached signature:
base=https://github.com/BitBoxSwiss/bitbox-wallet-app/releases/download/v4.51.3
curl -sSLO "$base/BitBox-4.51.3-macOS.dmg"
curl -sSLO "$base/BitBox-4.51.3-macOS.dmg.asc"
# Verify:
gpg --verify BitBox-4.51.3-macOS.dmg.asc BitBox-4.51.3-macOS.dmg
Result:
gpg: Signature made Thu Jul 9 16:27:45 2026
gpg: using RSA key DD09E41309750EBFAE0DEF63509249B068D215AE
gpg: Can't check signature: No public key
The signing key DD09E413…D215AE resolves (via keyserver.ubuntu.com) to ShiftCrypto Security <security@shiftcrypto.ch>, RSA 4096, created 2022-06-02. Once fetched from the keyserver, the signature verifies cleanly:
gpg: Good signature from "ShiftCrypto Security <security@shiftcrypto.ch>"
So the signature itself is fine — the gap is purely in key distribution.
Summary
The repo commits one public key to
pgp/pubkeys/—benma.asc— but the macOS release artifacts are signed by a different key ("ShiftCrypto Security",DD09E41309750EBFAE0DEF63509249B068D215AE) that isn't committed anywhere in the repo. A user following the natural workflow — import the repo's committed key, thengpg --verifythe download — hitsNo public keyand has to go find the real signer on a third-party keyserver. I'd like to propose committing the actual release-signing key topgp/pubkeys/so the key that signs the binaries inherits the same version-controlled trust as the source.Steps to reproduce (BitBoxApp 4.51.3, macOS DMG)
Result:
The signing key
DD09E413…D215AEresolves (viakeyserver.ubuntu.com) toShiftCrypto Security <security@shiftcrypto.ch>, RSA 4096, created 2022-06-02. Once fetched from the keyserver, the signature verifies cleanly:So the signature itself is fine — the gap is purely in key distribution.