Hello all, I am just going to update my tor server, building packages from source. I do that not only for tor but also for libevent. So I downloaded the tarballs plus signature from libevent.org and that's what I found: $ gpg --verify libevent-2.0.22-stable.tar.gz.asc gpg: Signature made Mon Jan 5 16:16:20 2015 CET using RSA key ID 8D29319A gpg: Good signature from "Nick Mathewson <nickm@alum.mit.edu>" gpg: aka "Nick Mathewson <nickm@wangafu.net>" gpg: aka "Nick Mathewson <nickm@freehaven.net>" gpg: aka "[jpeg image of size 3369]" $ gpg --verify libevent-2.1.8-stable.tar.gz.asc gpg: Signature made Sun Jan 29 19:42:03 2017 CET using RSA key ID 8EF8686D gpg: Good signature from "Azat Khuzhin <a3at.mail@gmail.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 9E3A C83A 2797 4B84 D1B3 401D B860 8684 8EF8 686D $ gpg --list-sigs "Azat Khuzhin" pub 2048R/8EF8686D 2010-06-10 uid Azat Khuzhin <a3at.mail@gmail.com> sig 3 8EF8686D 2010-06-10 Azat Khuzhin <a3at.mail@gmail.com> sub 2048R/7A34F923 2010-06-10 sig 8EF8686D 2010-06-10 Azat Khuzhin <a3at.mail@gmail.com> While nickm@alum.mit.edu was signed by many, many people, I find no signature for "Azat Khuzhin <a3at.mail@gmail.com>" at all. How can I trust that key? How can I be sure that libevent 2.1.8 is a good package? Why has Azat Khuzhin public key no signature from Nick Mathewson or anyone else? I don't trust that package for now until I find it signed with the keys of at least Nick Mathewson and Niels Provos. Correct me if I a wrong. Best Regards, Thomas