&expected_relay_pubkey

[sambacha]

check against the static pubkey, not the pubkey in the message

[ltitanb]

any reason for this? we check just above that the two keys are the same?
https://github.com/Commit-Boost/commit-boost-client/blob/main/crates/pbs/src/mev_boost/get_header.rs#L464-L469

[sambacha]

any reason for this? we check just above that the two keys are the same? main/crates/pbs/src/mev_boost/get_header.rs#L464-L469

expected is the relay url pubkey, the received key could be a different key and still pass signature check. Verifying the signature using the provided pubkey itself doesn't actually provide any benefit: it will always return valid. Hence why the pubkey is stored in the relay's url, this provides the pubkey to use for validity check.

Yes your correct.

Also I thought pub key was suppose to be the last part of the message or maybe I am misremembering