Hacker News Reader

That's very true. That's why Bintray has both "web identity verification" and pgp signing, while Maven Central gives you signing only, without a way to really identify the author.

View on HN

Fwiw, Bintray requires the private key and passphrase to do the signing. This isn't really proper key handling and has been pointed out before.

Brian, how ignorant of you (again). The docs on signing are public, you could read before spreading FUD.

Reply on news.ycombinator.com