2026-10-08 UTC
# 
Zegnat Is GPG signing still the norm at all? I haven’t done PHP releases in a while. I have seen a lot of node packaging slowly move to attestations instead: ie. Microsoft/GitHub signs that the contents of the release match the contents of the repository so you ensure that the code you see is the code you end up with. Which feels about as trustworthy as a GPG key from an open-source contributor that I also have a hard time verifying anyway.