I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard.
There are three parts.
Integrator the client which user uses it to create a software from the source and make it into a package.
Backend Server the software package will be upload into the server.
Target the client downloads the from server and verify it creates from a valid user or not.
So about the verification via signature.
Who should create a pair of keys? The user creates keys, gives private key to Integrator, uploads the public key to the server and always keeps the private key(to represent the user itself)? Or the server generate the keys and issue to the user?