-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Oops, forgot to sign it.
I'm kind of a corner case, but I can't use wkd because I don't control my top level domain for my email. I also can't use DANE for the same reason. I can and do use DNS CERT records because it allows a second-level domain. I suppose this has been discussed to death, but wouldn't it make sense to only allow external signatures on a key if they are cross-signed? That should prohibit third parties from adding junk to keys, but it doesn't prevent someone from making a key with your email address in it. I like the keybase.io approach of having publicly verifiable signatures to match a key to an id, but it only works for public ids such as github or facebook, rather than email. In the case of verifying signatures (for e.g. software distribution), just the id is needed, and no email is required. But in the case of encrypting to a stranger (for instance to send to a well-known reporter or something), the only way to trust the key is if they publicly sign something and put it on a publicly reachable website. It seems that in several well-known cases, such as Snowden, he just basically got lucky that the key in the keyserver network containing the Guardian's email address was in fact them and not an impostor. In the case of say a mailing list, tofu works pretty well, but still doesn't solve the problem of a cold communication with someone you've never before seen a signed message from. -----BEGIN PGP SIGNATURE----- iHUEARYIAB0WIQTu0BWAE9wubW4AHqQ3uVB6z/IBbgUCXRoW/QAKCRA3uVB6z/IB bka7AP9DdmupTNZ0S7vC3BNxvIaVSkPgMvee5Kjk6SGWbgs6egD/Z08z2UVYzEoC pSOA5HJmNDIQrOMZz2vUXL/ZA+OekwSIdQQBEQgAHRYhBPnEu3YOeD8N7BCmimuO s6Blz7qpBQJdGhb+AAoJEGuOs6Blz7qp5n0A/A1cGVLBAI5XWAI2zvgoLpeIU7vU lxucPzOQKSGWSJKpAP0X2LdUFg3kayoJvZZ2QntoZT7F2blAYXTUXTjvi75Wrw== =xsw2 -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
