.merge+ 1457

Added

so re: Tor, pigeons has pointed out that the download site is on a subdomain

and Tor doesn't do subdomains

so I'm just going to generate a vanity v3 onion for it

fluffypony: Alright, thanks. Please let me know when you have the address. I'm creating a doc that we will include in the repo with the onion address written on it. Then binaryFate will sign it, so people will be able to check that the address they are using is legit.

good idea

We should add the onion address of the downloads as well

I think it's easier to sign a text (similar to hashes) containing the TOR address rather than a detached signature for a file. So it can be copy/pasted easily on reddit and elsewhere. Opinions?

Sounds good to me

Might be a good idea to consider these guidelines as well dark.fail/spec/omg.txt

Interesting but at least partly overkill IMO. Not sure we need mirrors (threat model is very different from DNMs). Not sure about canary either in that context