fingerprint trusted entropic instances about entropic HOT 1 OPEN

I think the problem to solve is authenticating the packages themselves. If the server is serving signed packages, even if it goes rogue it can't serve bad packages without breaking their signatures.

Given that, then the problem is handling signatures in a user-friendly way. Having an entropic-run signatory authority is subject to centralization problems. I think you want fundamentally a gpg-style web of trust system where you have a method for trusting a package author's pubkey through a network. Generating those networks is hard, so I suggest leveraging something already-existing and robust, like Keybase.

So in net, I suggest

• Do not worry so much about authenticating Entropic servers
• Focus on cryptographically validating packages through some kind of key signing protocol from the package author
• Use Keybase or some other independent key distribution and validation platform to get a package author's public key to validate a package's signature

from entropic.