There is.
Comment on Don't Trust, Verify (or: Validating Origin and Integrity without Public CAs)
BrianTheeBiscuiteer@lemmy.world 4 days ago
If there’s a concern that an adversary can rewrite hashes then why is there not a concern the public key could also be rewritten and the hashes signed with the fake key?
non_burglar@lemmy.world 4 days ago
K3can@lemmy.radio 1 minute ago
The hashes aren’t tied to a specific identity, they’re just a simple way to convert a set of data into a unique, fixed-length string. The hashes could be rewritten, but without access to the site’s private key to sign them, they wont validate against the public key.
The key itself is also signed, so even if an adversary tricked you into downloading a fake public key, the fake key wouldn’t be signed by my personal key.
The important point is that it’s a layered system, rather than a single point of trust.