Messages in this thread | | | Date | Thu, 6 Oct 2011 10:48:02 -0700 | From | Greg KH <> | Subject | Re: kernel.org status: establishing a PGP web of trust |
| |
On Thu, Oct 06, 2011 at 06:39:40PM +0100, Mark Brown wrote: > On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote: > > > What I'd like to see is "keysigning" parties where folks with well > > established (in use) keys turn up and *prove* they own the key by > > signing some information the other attendees provide. That way they can > > not only say "hey, I'm dude X, trust me this is my fingerprint, here's a > > photo ID" (which means nothing in the case of a well established online > > identify that is trusted already), but they can say "hey, I have access > > to this key, because I just signed that random message you gave me > > interactively". Who cares who the heck they really are beyond that? > > (intentionally a loaded statement to make the point). > > A common approach to this for at least the e-mail portion of the address > is to sign the ID with the address and then mail the signed key > encrypted to the address, deleting all local copies and requiring that > the recipient publish the signature. This at least demonstrates that > the owner of the key can read mail at that address.
The 'caff' tool does this for you automatically. I just learned of it yesterday, and already it's saved me loads of time. Highly recommended, and odds are it's already packaged up for you in your distro.
greg k-h
| |