Paul Slootman <[EMAIL PROTECTED]> writes: > How do you prove to whoever is able to erase the package that you > are who you say you are? I.e. how do you convince them that they > should in fact erase the package?
You do that by sending them a message signed with a new key, that you have had signed by someone else. As long as people don't adopt the ``I'll sign anything you like, once I've met you once'' attitude, this works. To address the ``If you trust it for anything, you should trust it for everything'' argument, lets try to draw an analogy in the real world: Lets say you are a bank manager, and you have a list of all your customer's signatures (which are difficult to forge). Customer A sends you a signed letter, instructing you to transfer 100.00 to another person's account. Customer B mails you a signed letter saying that they have had plastic surgery, and changed their name, and not only do they want you to transfer all future control of the account into this new name, but they also want you to sign an affidavit saying that you're sure that these two names apply to the same person. I think you're quite likely to do as requested by ``A'', but will request that customer B come in, in person, with all required documentation to prove their claims, before doing what they asked. If any of the people reading this treat key signing any less seriously than signing such an affidavit, then please speak up so that the rest of us can tell PGP/GPG that your signatures are proof of nothing much. Cheers, Phil.
