On Wed, Nov 3, 2021, 9:38 PM grarpamp <[1]grarpamp@gmail.com> wrote:

     > I thought of sharing the keys I found but they are a few hundred
     megabytes
     The keys are small,
     the fake sigs are the bloat,
     they can be removed,
     leaving a small package again.

   would you propose removing only the sigs that are clearly fake? how do
   people judge what is useful?  anyway i'm unlikely to put too much time
   into fighting with pgp lists more atm, unless needed.

     naclbox has quite some dependencies
     for win/mac and even unix users,
     hardly as easy as a gpg or age
     binary dl/pkg or a single compile from tarball.

   in my internet nacl hasn't been updated since 2011, maybe I have
   something wrong but this surprises me.  doesn't look dependency heavy
   to me.

References

   1. mailto:grarpamp@gmail.com