Details, please! Is this PWA distribution via nostr events? Or is the PWA signature on nostr? What is signed there? I'm very eager to learn for WalletScrutiny where I had PWAs kind of dismissed as impossible to get secure against hacked servers for example.

Replies (1)

On Google phones, the OS won't let you down-grade apps or upgrade them to a version that's signed by a different key. I want this for PWAs. Of course, as admin I want to be able to override it but it would be great to have such a lock-in that no random hacker on a webserver could circumvent.