• PEM-encoded certificate
• LibrePGP detached signature
• OpenSSH signature
• KEKS/CM signature

$ for ext in "" .asc .sig .cm ; do fetch http://www.ca.stargrave.org/cert.pem$ext ; done

$ curl http://openpgpkey.stargrave.org/.well-known/openpgpkey/stargrave.org/hu/s8kd45yyt8ymu6uttefkjkngyagsui5x.asc | gpg --import
$ gpg --auto-key-locate dane --locate-keys stargrave@stargrave.org
$ gpg --auto-key-locate  wkd --locate-keys stargrave@stargrave.org
$ gpg --auto-key-locate  wkd --locate-keys stargrave@gnupg.net
$ gpg --check-sigs stargrave@stargrave.org
$ gpg --verify cert.pem.asc

$ curl http://www.stargrave.org/keys/stargrave@stargrave.org.pub | perl -lane 'print "$F[2] $F[0] $F[1]"' >stargrave@stargrave.org.pub
$ ssh-keygen -Y verify -f stargrave@stargrave.org.pub -I stargrave@stargrave.org -n file -s cert.pem.sig <cert.pem

$ fetch http://www.stargrave.org/keys/stargrave@stargrave.org-sig.cm
$ fpr=$(kekspp -v -p /id <stargrave@stargrave.org-sig.cm)
$ mkdir pubs
$ ln -s ../stargrave@stargrave.org-sig.cm pubs/$fpr
$ cat cert.pem.cm cert.pem | cmsigtool -d -v -pubs pubs

$ git config http.sslCAInfo $PWD/cert.pem
$ export SSL_CERT_FILE=$PWD/cert.pem