I was trying to install Emacs on my Windows 8.1 machine (thus WSL is not an option). I downloaded the file from a mirror (emacs-26.3-x86_64.zip), along with his signature (emacs-26.3-x86_64.zip.sig). However, when I try to verify it with Cygwin, I get this:
$ gpg --verify emacs-26.3-x86_64.zip.sig emacs-26.3-x86_64.zip gpg: Signature made 08/30/19 14:04:16 ope gpg: using RSA key 84930FFB79B645F7DEA29AD0AC6DD3FFD1D046BD gpg: Good signature from "Phillip Lord <firstname.lastname@example.org>" [expired] gpg: aka "Phillip Lord <email@example.com>" [expired] gpg: WARNING: This key has been revoked by its owner! gpg: This could mean that the signature is forged. gpg: reason for revocation: No reason specified gpg: revocation comment: Revocation Certification produced at generation time gpg: Note: This key has expired! Primary key fingerprint: 8493 0FFB 79B6 45F7 DEA2 9AD0 AC6D D3FF D1D0 46BD
Now, is this file safe to install?