Re: kernel.org status: establishing a PGP web of trust

[Valdis . Kletnieks]

On Thu, 06 Oct 2011 11:58:22 EDT, Jon Masters said:

> What I'd like to see is "keysigning" parties where folks with well
> established (in use) keys turn up and *prove* they own the key by
> signing some information the other attendees provide. That way they can
> not only say "hey, I'm dude X, trust me this is my fingerprint, here's a
> photo ID" (which means nothing in the case of a well established online
> identify that is trusted already), but they can say "hey, I have access
> to this key, because I just signed that random message you gave me
> interactively". 

Wouldn't the fact that I attend the keysigning party and claim that I was
the owner of key B4D3D7B0, and then subsequently signing your key with
that same key, prove that I actually controlled key B4D3D7B0?

The other possibility is that I was an impostor *and* that the real owner of
key B4D3D7B0 was coincidentally going around that same day and signing keys for
everybody at the keysigning without doing proper verification.  Which you have
to admit is rather a long shot...

Attachment: pgp00000.pgp
Description: PGP signature