And, of course their site is HTTP only, including the path for their PGP signing...

		rhinoceraptor on Aug 26, 2019 \| parent \| context \| favorite \| on: Webmin 1.890 Exploit – What Happened? And, of course their site is HTTP only, including the path for their PGP signing key (!!!). They do have a valid Let's Encrypt cert, but apparently it's only configured for the `download` subdomain.