Part 2: Three Ways the Last Mile Breaks

A Margo Compose app today is a tarball at a URL, its signing key typically at another URL on the same server. Nothing lets the receiving device prove the file it pulled is the file the author published. Here are the three ways that bites — none exotic, all reproducible against today's Pre-Draft.