According to MSDN, it is a recommended practice to include both the private and public keys used for strong-naming assemblies into the public source control system if you're developing open-source software:
If you are an open-source developer and you want the identity benefits of a strong-named assembly, consider checking in the private key associated with an assembly into your source control system.
This is something that confuses me greatly. Making the private key public? Wouldn't the whole purpose and security of asymmetric cryptography be defeated in this case?
I see in the same article this note:
Do not rely on strong names for security. They provide a unique identity only.
This does not help reduce my confusion. Why then use a private-public key pair if security is not the aim? Is the strong-naming mechanism in .NET using private-public key pairs in an inappropriate way? My guess is that I'm missing or misunderstanding something.