[llambiel]

I agree with your concern. As a temporary "workaround" I've updated the article with a SHA256 checksum of the key. I'll chase the Nginx team for serving this key over https

[click170]

We should really be verifying the fingerprint of the key itself, even if it is served over HTTPS.

[schoen]

Thanks for the update!