Clarify GPG verification

docker-library · Oct 7, 2021 · 7823d46 · 7823d46
1 parent 4ede2f8
commit 7823d46
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/README.md b/README.md
@@ -251,6 +251,7 @@ Below are some examples:
 	    # install
 	```
 
+-	**Note:**: verifying the gpg signature of the hash file only is as secure as verifying the signature of the data itself and common practice (given that it's a strong hash)
 -	**Alternate**: *full key fingerprint imported to apt which will check signatures and checksums when packages are downloaded and installed.*
 
 	```Dockerfile