On: OpenSSL.org hacked?

[userbinator]

But would they also be able to replace the public key of the authors in all the other places it appears on the Internet?

[dionyziz → userbinator]

That. That's why the authors PGP-sign their sources. Furthermore, some of us maintain GPG trust paths, so replacing it on every other place on the Internet would still be futile.

[dmix → dionyziz]

There is also benefits of using decentralized distribution channels like bittorrent. So a single source can't be compromised.