mirror of
https://github.com/openglow-org/forgefirm.git
synced 2026-09-28 09:11:11 -07:00
The embedded pubkey is the production key from the signing ceremony; release.sh's key-match gate now refuses any other signer. Verified: production-signed archives pass fwup 1.16 and the factory's 0.14.2; dev-signed archives are rejected.