That was what I prefer to read instead, but fine

Edit: I did watch it, they don’t even tell, because it was in the previous disclosure, so I now need to find and watch that one

Edit2: and from reading https://gpg.fail/ with original vulnerability descriptions I can’t understand how they did the trick with ISO, is the ISO signed as if it were plaintext and allowed truncated lines? If so, this does look pretty bad both on implementation side and on user side, imo