Hacker News Reader

You could say this about any service serving software artifacts?

Unsigned ones, yes.

That just moves the trust requirement up the chain, and assumes that the image wasn’t compromised pre-signing (either intentionally or unintentionally)

It doesn't, it removes/reduces one step, and leaves another one that is there regardless.

Reply on news.ycombinator.com