I wonder something every time I download Mullvad’s updated VPN client. ‘Verify this download with the GPG signature’, it tells me.

But surely if I’m in a position where I’ve poisoned Mullvad’s executable, I’m also in a position where I’ve doctored the GPG sig to match? That sig just being something that I download from mullvad.net.

Unless it’s somehow independently verified, I’m not sure that I see the point?

(Or anything else similar. Not picking on Mullvad, it’s just the one that comes to mind.)