Re: kernel.org status: establishing a PGP web of trust

Mark Brown
2011-10-06T17:40:14Z

On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote:

> What I'd like to see is "keysigning" parties where folks with well
> established (in use) keys turn up and *prove* they own the key by
> signing some information the other attendees provide. That way they can
> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
> photo ID" (which means nothing in the case of a well established online
> identify that is trusted already), but they can say "hey, I have access
> to this key, because I just signed that random message you gave me
> interactively". Who cares who the heck they really are beyond that?
> (intentionally a loaded statement to make the point).

A common approach to this for at least the e-mail portion of the address
is to sign the ID with the address and then mail the signed key
encrypted to the address, deleting all local copies and requiring that
the recipient publish the signature. This at least demonstrates that
the owner of the key can read mail at that address.