sure man
Here’s the CalyxOS statement about delayed security updates due to departing leadership.
Notable excerpt:
we announced a recent leadership transition. When senior personnel have access to signing keys and leave a team, it is security best practice to update signing keys and conduct audits…for the time being, current CalyxOS users will not be able to receive further security software updates until our new security protocols are in place
Here’s a detailed assessment by the GrapheneOS team. I know their language style often tends to dissuade a lot of folks, but the two projects shared a lot of developers over the years, they have some insights to the situation that cant be dismissed outright. One of the departing CalyxOS leaders (not associated with Phreeli, so far as Im aware) created an account to leave some comments on the thread
Notable excerpt from GOS dev team:
If Calyx had access to the signing keys, they could quickly make a release rotating nearly all of the OS keys including the ones for signing OS and app updates… Nicolas Merrill is the sole person who had access to the signing keys despite not being a developer involved in CalyxOS development and CalyxOS being entirely created and managed as part of Calyx. He appears to be refusing to turn over the signing keys to them, otherwise they could have continued doing updates and could have rotated everything other than the verified boot keys. Calyx is not being transparent about what’s happening and why they’re making these decisions.
To date, neither party has been fully transparent with the sizeable CalyxOS user base, whose devices became worthless between 1Aug and 5Aug. I leave you to draw your own conclusions. I do not intend to badmouth any individuals or organizations involved. I endorse no opinions included in either publication, I am just sharing information. Personally, I need more transparency from Merrill before entrusting him with any kind of data. Same goes for Calyx Institute