Incorrect Key Verification

in-toto is vulnerable to Incorrect Key Verification. The vulnerability exists because GnuPG is not invoked during key verification when specifying the PGP key via its ID, which allows an attacker to bypass validity checks inside GnuPG. For example, because in-toto does not properly use GnuPG, a P...