Hello all,

I am just going to update my tor server, building packages from source. I do that not only for tor but also for libevent. So I downloaded the tarballs plus signature from libevent.org and that's what I found:

$ gpg --verify libevent-2.0.22-stable.tar.gz.asc gpg: Signature made Mon Jan 5 16:16:20 2015 CET using RSA key ID 8D29319A gpg: Good signature from "Nick Mathewson nickm@alum.mit.edu" gpg: aka "Nick Mathewson nickm@wangafu.net" gpg: aka "Nick Mathewson nickm@freehaven.net" gpg: aka "[jpeg image of size 3369]"

$ gpg --verify libevent-2.1.8-stable.tar.gz.asc gpg: Signature made Sun Jan 29 19:42:03 2017 CET using RSA key ID 8EF8686D gpg: Good signature from "Azat Khuzhin a3at.mail@gmail.com" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 9E3A C83A 2797 4B84 D1B3 401D B860 8684 8EF8 686D

$ gpg --list-sigs "Azat Khuzhin" pub 2048R/8EF8686D 2010-06-10 uid Azat Khuzhin a3at.mail@gmail.com sig 3 8EF8686D 2010-06-10 Azat Khuzhin a3at.mail@gmail.com sub 2048R/7A34F923 2010-06-10 sig 8EF8686D 2010-06-10 Azat Khuzhin a3at.mail@gmail.com

While nickm@alum.mit.edu was signed by many, many people, I find no signature for "Azat Khuzhin a3at.mail@gmail.com" at all. How can I trust that key? How can I be sure that libevent 2.1.8 is a good package? Why has Azat Khuzhin public key no signature from Nick Mathewson or anyone else? I don't trust that package for now until I find it signed with the keys of at least Nick Mathewson and Niels Provos.

Correct me if I a wrong.

Best Regards, Thomas