Thank you @stevedennis, this makes sense. One odd thing is that I noted that when I had set metadatacache=true using pgutil, the time the WebUI showed Loading Packages.... and the time it took to do sudo apt update in clients went from long to super long. It went back to long when I set metadatacache=false again. I don't know if there is a logical explanation for this or of it was just a coincidence. Br, Stefan

Hi @stevedennis, thank you. I contemplated the idea store the fingerprint in another location (and doing so at a point in time when I'm convinced things are not compromised), and then, when a new host is to subscribe to the ProGet feed, compare the calculated fingerprint of the ProGet provided key with the one obtained from the other store. If they do not match I know one of them have been tampered with. But maybe I'm going overboard, and I still can do it by downloading the key to the second location and calculating the fingerprint there if I really want to, so things are fine. Thank you again, Stefan

Hi Steve, thank you! I will try badssl.com out and see how ProGet reacts. Thank you again, Stefan

Thanks @rhessinger, that clarifies things, and I can move on. Best regards, Stefan

Great, thanks!

Hi Steve, I fully understand. I will carry on using the existing format then. Thanks for the tip regarding use of pgutil! Thanks, Stefan