Why is it recommended to include the private key used for assembly signing in open-source repositories? : <p>According to <a href="https://msdn.microsoft.com/en-us/library/wd40t7ad(v=vs.110).aspx" rel="noreferrer">MSDN</a>, it is a recommended practice to include both the private and public keys used for strong-naming assemblies into the public source control system if you're developing open-source software:</p>

<blockquote>
  <p>If you are an open-source developer and you want the identity benefits of a strong-named assembly, consider checking in the private key associated with an assembly into your source control system.</p>
</blockquote>

<p>This is something that confuses me greatly. Making the private key public? Wouldn't the whole purpose and security of asymmetric cryptography be defeated in this case?</p>

<p>I see in the same article this note:</p>

<blockquote>
  <p>Do not rely on strong names for security. They provide a unique identity only.</p>
</blockquote>

<p>This does not help reduce my confusion. Why then use a private-public key pair if security is not the aim? Is the strong-naming mechanism in .NET using private-public key pairs in an inappropriate way? My guess is that I'm missing or misunderstanding something.</p>
