Re: Replacement GPG key for Lorenzo Stoakes

["Uwe Kleine-König" <u.kleine-koenig@baylibre.com>]

[-- Attachment #1: Type: text/plain, Size: 1593 bytes --]

Hello Konstantin,

On Wed, Apr 22, 2026 at 09:39:13AM -0400, Konstantin Ryabitsev wrote:
> On Wed, Apr 22, 2026 at 11:19:36AM +0200, Uwe Kleine-König wrote:
> > > > So to establish the required trust, I had the new key signed by people with
> > > > the requisite level of trust. I attach the key here.
> > > > 
> > > > Could you please remove the old and replace it with the new?
> > > 
> > > Done now. Thanks!
> > 
> > I see you removed the old key from Lorenzo. I wonder if it would make
> > sense to add the revoked key instead of deleting it to spread the
> > information that it shouldn't be used any more.
> 
> If the key is lost, then this serves very little practical purpose, beyond
> advertising that the old encryption subkey should not be used. Since we almost
> never use encryption anyway (just attestation), then this is just effort for
> very little gain.

The effort however is also very low, it's just:

gpg --import revoked.asc
{
  gpg --list-options show-notations,no-show-uid-validity --with-subkey-fingerprints --list-key C52D7AFE85F25509;
  gpg -a --export --allow-weak-digest-algos --allow-weak-key-signatures --export-options export-attributes,export-clean C52D7AFE85F25509;
} > keys/C52D7AFE85F25509.asc
git commit -m 'Add revoked key C52D7AFE85F25509 (Lorenzo Stoakes)' keys/C52D7AFE85F25509.asc

Distributing the revokation also has the advantage that if someone
wonders why they see an attestation from Lorenzo using a new key, the
revokation gives a good additional indication that the new key is
legitimate.

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]