It's annoying when software developers give you a pgp signature. But no certificate I can verify it against.