Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server.
I would like to include authenticating these updates before applying them, i.e., that these updates are cryptographically signed.
My suggestion is to use Asymmetric Encryption, this requires distributing the Public Key with the executable running on the client machine. The download server will sign the updates with the private key. This would allow the client machine use the public key to verify the updates.
My questions:
Is this the general standard approach?
Would the public key be generally pushed with the executable running on the client machine or would this just be a look up via some REST API?
Do Apple (or others) implement a similar approach when they verify the downloaded file for when they are applying an update to the IOS platform?
Would I need to include the use of a certificate ?
I am not interested in merits of TLS etc.