Ask HN: Why doesn't Moxie sign Signal's releases?

Crypto experts don't follow "good practice" for the sake of it; they do things that would meaningfully improve security.

If it's distributed using Google play store aren't apks signed by the developer anyway?

On Android or iOS or did you mean sign a source release ...?

My guess is because of potential friction with reproducible building (for Android) and this for iOS: https://github.com/WhisperSystems/Signal-iOS/issues/1063

hth, adric

I don't know, but am I right in saying that he is generally in favour of ephemerality over verifiability? It'd seem odd to do this with definitely attributable works like software releases, but it is what would make most sense to me.