Valid concern, yet a potentially solved problem. For code signing at least. Chexk out Time Stamping.

More info: https://sslinsights.com/code-signing-time-stamping/

They have a solution for that, called privacy pass. It uses tokens to show the system you are a paid user, but supposedly does not reveal who you are.

I haven't tried it myself, so I have no idea if it works as it should. I'm still deciding to subscribe or not.

More info: https://help.kagi.com/kagi/privacy/privacy-pass.html

Machine Head - Struck A Nerve

The more things change, the more they stay the same.

Wise words, lovely song.

Thats why some PIN screen implementations have PIN screen scrambling. It can defeat shoulder surfing.

It's the attack path.

How did you know f-droid's certificate was about to expire? Do you keep track?

It's not 'about to' it's expired. Did you not get a warning?

In Firefox it's easy to see the details of the HTTPS certificate by clicking on the small padlock in the navigation bar.

"Autoruns" is the sysinternals tool you're talking about ;)

Ah yeah, that's the one.

I don't know what the current situation is, but the amount of crapware back in the day was just staggering; every installer offered to "helpfully" install an extra toolbar or virus scanner or whatnot, which is how people ended up with 3 virus scanners and 8 toolbars in IE.

An AP or wlan router that supports vlan to ssid mapping.

At least GrapheneOS devs are transparant about it, as it should:

https://grapheneos.org/faq#default-connections

Would you be willing to share your full list?

Not in its entirety, but these are some of the more helpful "global" non-default rules I employ on some of my "more restrictive" / "less advertising" / "less tracking" PiHoles DNS resolvers:

[BLACKLIST]:

(\.|^)google-analytics\.com$

(\.|^)googlesyndication\.com$

(\.|^)googletagservices\.com$

(\.|^)google\.com$

(\.|^)douclick\.net$

(\.|^)doubleclick\.net$

(\.|^)facebook\.com$

(\.|^)fb\.com$

(\.|^)fbcdn\.net$

(\.|^)googleapis\.com$

(\.|^)disqus\.com$

(\.|^)gstatic\.com$

(\.|^)apple-dns\.net$

(\.|^)salesforceliveagent\.com$

(\.|^)salesforce\.com$

(\.|^)force\.com$

(\.|^)apple\.news$

getpocket.com

reddit.com

[WHITELIST]:

youtube-ui.l.google.com

maps.googleapis.com

maps.gstatic.com

streetviewpixels-pa.googleapis.com