Is this the right signing key?

[soaringowl2145]

when I run gpg --verify SHA512SUMS.sign

I get this.

gpg: Signature made Tue 17 Jan 2017 04:20:40 AM EST
gpg: using RSA key DA87E80D6294BE9B
gpg: Can't check signature: No public key


==========================

However the official key that is in the documentation says this should say:

pub 4096R/6294BE9B 2011-01-05
Key fingerprint = DF9B 9C49 EAA9 2984 3258 9D76 DA87 E80D 6294 BE9B
uid Debian CD signing key <debian-cd@lists.debian.org>
sub 4096R/11CD9819 2011-01-05

=======================

Currently I am using archlinux.

Is this the same key? When i import the key DA87E80D6294BE9B --- I still get the same key fingerprint.

Is there any documentation somewhere that proves the key DA87E80D6294BE9B is correct?

Thanks!

[alex.theoto]

You are ok. https://www.meebey.net/posts/secure_usb ... th_debian/

[dasein]

Is there any documentation somewhere that proves the key DA87E80D6294BE9B is correct?

You're willing to blindly trust Web content? You're obviously assuming that your NIC and/or your CPU aren't undetectably compromised. But without hard evidence supporting that assumption, you're still relying on blind faith.

And you haven't even begun to consider the scenario where a backdoor was surreptitiously placed in kernel code, cleverly hidden in such a way as to make detection almost impossible within the millions of lines of surrounding code. All that extra effort just to confirm that compromised code has been successfully installed on your system.

See also: http://forums.debian.net/viewtopic.php? ... =0#p512113