Review Results

Comment

The change only adds a comment advising users to refresh the Tor Browser signing keyring if makepkg reports an unknown public key. It does not alter build logic, sources, install scripts, permissions, or package contents. No security-relevant behavior is introduced by this diff.

@@ -11,6 +11,9 @@
 #
 #     gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org
 #
+# Tor Browser rotates its signing subkeys: if makepkg reports an unknown
+# public key, re-run the command above to refresh the keyring.
+#
 # If you want to update tor-browser from AUR without AUR helpers you can run in a terminal:
 #
 #     tor-browser -u