@phnt @chris9x @mint @threat No protections around outbound requests, so "fetch the key to verify the sig" and the race before the key is fetched (no locking) means your server makes N simultaneous outbound requests to get that file.