[outsomnia]

> The main lesson is: one should not rely on the secrecy of public keys

... that might be why they are called "public" keys

[dnet]

Yet we've had people argue that they wouldn't give us the public part of their JWT RSA signing keypair, because "they wouldn't publish that anyway", hence this post.