New signing keys for v1.3.2

[philsmart]

It appears the singing key for duo-universal-sdk v1.3.2 has changed from v1.3.1. The previous key used for version <= 1.3.1 (which has expired):

pub   rsa4096 2020-11-10 [SC] [expired: 2026-01-27]
      20FF0D66B2D0202C154473397E77F31E27A4AEA2

The key used to sign v1.3.2 in Maven Central:

pub   rsa4096 2026-03-20 [SC] [expires: 2029-03-19]
      7ED4A7803AFC6DE847DF9A3F70EE73F217012D0E

I need to be able to do independent verification that the certificate and key we're verifying against for duo-universal-sdk-1.3.2.jar from Maven Central [1] is indeed the one you intend so that we don't find ourselves incorrectly verifying against a key that isn't yours. Do you publish your trusted signing keys somewhere?

[1] https://repo1.maven.org/maven2/com/duosecurity/duo-universal-sdk/1.3.2/

[jeffreyparker]

Hi @philsmart !

The updated signing key is on keyserver.ubuntu.com https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x7ED4A7803AFC6DE847DF9A3F70EE73F217012D0E

We're still working on getting it added to keys.openpgp.org

[scantor]

Unfortunately unless that's signed by a key somebody has a reason to trust, it doesn't help any. What we need is a trusted association to this project. You do that in most cases by adding a PGP_KEYS file to the project that's maintained any time keys change. The ability to update that file is implied trusted since such a committer could also change the code itself, so it is inherently assumed to be trusted at that point.