Journalist fetching keys are signed and verified using the newsroom key instead of their own signing key

[lsd-cat]

The bug is repeated all across the code and that is why there are no signatures mismatch. Caught it when refactoring for the libsodium-only branch. If we merge that there is no need to do anything as it is fixed there. If we end up not merging, then we should track it in this issue and eventually fix it.

(non exhaustive list):

• https://github.com/freedomofpress/securedrop-poc/blob/5ec5fda3024562ea0304698d4767ee5dedd15ec9/pki.py#L144
• https://github.com/freedomofpress/securedrop-poc/blob/5ec5fda3024562ea0304698d4767ee5dedd15ec9/pki.py#L173
• https://github.com/freedomofpress/securedrop-poc/blob/5ec5fda3024562ea0304698d4767ee5dedd15ec9/server.py#L54
• https://github.com/freedomofpress/securedrop-poc/blob/5ec5fda3024562ea0304698d4767ee5dedd15ec9/commons.py#L70

[lsd-cat]

Closing as we merged #24 that includes a fix.