[0xDEAFBEAD]

>When I've found security vulnerabilities in somebody's code, I can't think of a time I ever thought about GPG-signing my notice to them.

It's not authenticity that matters here, it's confidentiality.

[tptacek]

Basically nobody cares. Vulnerability researchers don't use GPG either.