thejohnnycrypto on Nostr: Zapstore does the certificate ownership check verify against a key the dev publishes ...

Zapstore (nprofile…tdq0) does the certificate ownership check verify against a key the dev publishes on nostr, or just against whatever signed the version already on the device? that difference decides whether a stolen signing key can quietly push an update.