Mozilla Firefox Signing Key: Critical Revocation

Mozilla revoked a GPG signing subkey after an unencrypted copy was accidentally committed to a private GitHub repository; the key signed Firefox and Thunderbird Linux packages, tarballs, and checksum files. Mozilla found no evidence of unauthorized access or misuse, provided replacement keys and a revocation certificate, and advised administrators and users (particularly on older Fedora/RHEL/Rocky/AlmaLinux/SUSE systems) to obtain and verify the new key material and update procedures to protect signing keys.