MOZILLA REVOKES FIREFOX SIGNING KEY AFTER UNENCRYPTED COPY LANDS IN GITHUB

Summary from the TLDR InfoSec newsletter

Mozilla revoked and replaced a GPG private subkey after an unencrypted copy of it was pushed to a private GitHub repository. The key signed Firefox and Thunderbird Linux tarballs, RPM packages, and checksums. Mozilla found no unauthorized access in the available audit records, but manual signature verifiers must import the new key and revoke the old key.