Re: PGP keysigning at LPC/OSSE 2026

["Uwe Kleine-König" <u.kleine-koenig@baylibre.com>]

[-- Attachment #1: Type: text/plain, Size: 2633 bytes --]

Hello Krzysztof,

On Wed, Aug 05, 2026 at 08:32:22AM +0200, Krzysztof Kozlowski wrote:
> While as much as I like key signing, I do not believe in
> Zimmermann–Sassaman protocol to work, because of people's negligence. It
> requires the participants to check if THEIR key is correct, but based on
> my recent practice (people generated new key and week later they lost
> password to it; people received my signed keys and could not decrypt the
> message because they never used encrypted email, people sent me emails
> asking to send their keys) I think it has significant risk of this not
> happening. People just do not understand the security principles here
> thus they do not think certain steps are an absolute requirement.

I see your point. However if Bob confirms his fingerprint on the
Zimmermann–Sassaman list is right while he didn't actually checked and
as an effect a forged certificate is signed, that's mostly Bob's
problem.

Also if Bob doesn't check his own fingerprint, he probably also doesn't
check the certificates he signs carefully and thus his signatures
shouldn't be trusted.

That's why a keysigning is about a *web* of trust where the (little?)
trust in each individual path between me and a given other person sums
up.

> IOW, I do not believe people will check their key fingerprints and email
> IDs, they will gladly accept what you prepared on the server and that
> could have been modified by an attacker or mischievous actor wanting to
> prank us.
> 
> That's why I require that the keys to be given to me must be prepared by
> that owner, not by a third party. I have some proofs that at least that
> key was in the possession of the owner, when he was preparing it. I will
> be happy to sign keys of developers given to me that way.

Last time I talked to Greg about these paper slips, he had trouble
finding gpg-key2ps on Arch and I prepared the postscript file for him :-D

> I know that you want to speed it up, but honestly korg keysigning should
> not have that many participants, so exchanging key slips should be fine
> as I was doing in the past.

I think even if we're only 10 in the end, the speedup is noticeable. And
it also simplifies the actual signing process for everyone, as I will
provide a keyring of all the handed in certificates.

If you still want a paper slip from each participant before being ok to
sign their certificate, that's fine. I'm still convinced that preparing
the Zimmermann–Sassaman list is a net win. And you're welcome to
participate no matter if your cert is on the list or not.

Best regards
Uwe

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]