Description William Sjöblom 2024-09-06 16:54:40 CEST

- https://www.cendio.com/resources/docs/tag/install_install.html#verifying-the-server-rpm
- https://www.cendio.com/resources/docs/tag/client_linux.html#verifying-the-client-rpms

Right now, these sections *assumes* the user is aware of good security practices. An example of this could for example be downloading the public key at different times from different places and comparing it.

As it stands right now, reading these sections makes it sound like verifying the RPMs using the public key in the same ZIP is a valid way to ensure authenticity of the RPMs.

The fact that we do not mention such practices is problematic for two reasons:

1. New users may get a false sense of trust by missing out on these security practices. 

2. Experienced users that know about these practices may loose confidence in Cendios general security practices for failing to mention it.