This is exactly how I understand it. So at the end, there should be no difference between the two ways. Instead you were suggesting that DVDs add additional problems in the verification, where I don’t see any.
Well, here you probably meant that the Qubes team should verify every DVD. However, I suggest it might not be needed, since users can do it themselves, just like you do not verify that the infrastructure doesn’t tamper with the ISOs.
I also see now that it was a reply to
so the context was that a users wants to skip any verifications of the DVDs. This is of course not possible, I agree. Looks like my misunderstanding, sorry.
Good post… Yes i posted this just now.
Why are there three different dates for the masterkey? Which is even the original date? There should be one date am i right? Other keys could be spoofed…