| From | Ben Pfaff <> | Subject | Re: kernel.org status: establishing a PGP web of trust | Date | Sun, 02 Oct 2011 18:18:43 -0700 |
| |
"H. Peter Anvin" <hpa@zytor.com> writes:
> 5. Get as many other kernel developers that you have physical access to > to sign your key after verifying the fingerprint. Verifying keys > over the phone is OK if and only if you know them *extremely* well; > think "would I be willing to testify in court that the person I > talked to was X"?
There is already an extensive Debian web of trust, and along with it a keysigning coordination effort and even a long list of Debian developers who offer to sign keys, with their physical locations and email addresses: http://wiki.debian.org/Keysigning/Offers
I wonder whether either effort would benefit from joining forces? I am also sure that there is overlap between Debian developers and kernel developers. -- Ben Pfaff http://benpfaff.org
|