Re: kernel.org status: establishing a PGP web of trust

[Mark Brown]

On Thu, Oct 06, 2011 at 11:58:22AM -0400, Jon Masters wrote:

> What I'd like to see is "keysigning" parties where folks with well
> established (in use) keys turn up and *prove* they own the key by
> signing some information the other attendees provide. That way they can
> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
> photo ID" (which means nothing in the case of a well established online
> identify that is trusted already), but they can say "hey, I have access
> to this key, because I just signed that random message you gave me
> interactively". Who cares who the heck they really are beyond that?
> (intentionally a loaded statement to make the point).

A common approach to this for at least the e-mail portion of the address
is to sign the ID with the address and then mail the signed key
encrypted to the address, deleting all local copies and requiring that
the recipient publish the signature.  This at least demonstrates that
the owner of the key can read mail at that address.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/