Messages in this thread | | | Date | Thu, 6 Oct 2011 18:39:40 +0100 | From | Mark Brown <> | Subject | Re: kernel.org status: establishing a PGP web of trust |
| |
On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote:
> What I'd like to see is "keysigning" parties where folks with well > established (in use) keys turn up and *prove* they own the key by > signing some information the other attendees provide. That way they can > not only say "hey, I'm dude X, trust me this is my fingerprint, here's a > photo ID" (which means nothing in the case of a well established online > identify that is trusted already), but they can say "hey, I have access > to this key, because I just signed that random message you gave me > interactively". Who cares who the heck they really are beyond that? > (intentionally a loaded statement to make the point).
A common approach to this for at least the e-mail portion of the address is to sign the ID with the address and then mail the signed key encrypted to the address, deleting all local copies and requiring that the recipient publish the signature. This at least demonstrates that the owner of the key can read mail at that address.
| |