I'd prefer at least one place other than Github, that can be identified as belonging to you.
As for keyservers, those don't count as anyone can upload a fake key to a keyserver, so it doesn't provide
independent verification.
(A theoretical attacker who gained control of your github account and tagged a fake release using a fake key, would have no problem also uploading the fake key to the keyserver. But there's a pretty good chance he didn't also gain the ability to publish to the official Sigil blog.)
For example, the blog states the following information regarding the OSX releases:
Quote:
|
Originally Posted by Sigil-ebook.com
There will be a lot of output but you should look for the following: Authority=Developer ID Application: Kevin Hendricks (2SMCVQU3CJ)
|