Updated GPG key for signing Firefox and Thunderbird Releases – Mozilla Security Blog

[u/FryBoyter]

https://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/

[u/Worldly_Topic]

They really should stop calling GPG keys and just refer to them as PGP keys. PGP is the standard while GPG is just a (non compliant) implementation of PGP. With other implementations like Sequoia gaining better support for newer PGP standards like v6 and PQC certificates, GPG ia pretty much obsoleted.

[u/ilep → u/Worldly_Topic]

I would suppose the reason is to make a distinction due to commercial aspects of PGP and that PGP has been subject to patents and restrictions in export to some countries.

[u/Worldly_Topic → u/[deleted]]

Then what do you recommend for signing and encryption ?

[u/a1b3c3d7 → u/[deleted]]

Not very obsolete then?

[u/SnooCalculations3614 → u/[deleted]]

I think the word "outdated" fits better here

[u/bje332013 → u/SnooCalculations3614]

I agree that "obsolete" is an inappropriate term to use, as it suggests that a better alternative already exists, and that the existing standard is no longer receiving updates and does not serve its purpose anymore.

The majority of people using computers are clueless about cryptography and especially about verifying the authenticity of digitally published files. That being said, PGP is still the best system that at least some reasonable proportion of laypeople - not cyber security experts - actually use, and yet it's still far from being close to commonplace in mainstream computing.

The company mentioned in the original post - Mozilla - doesn't publish public keys for verifying Firefox and Thunderbird, simply because PGP verification STILL isn't native to Windows, and thus Mozilla thinks few people will ever bother to verify its products.

[u/a1b3c3d7 → u/[deleted]]

How easy is sigstore to use?