Re: I am still on the keyring. With my old key.
2005/11/21, Henning Makholm <henning@makholm.net>:
> It can be considered bad from a technical viewpoint - as far as I
> understand the master copy of the keyring is currently on a medium
> that is under the keyring maintainer's direct physical control.
>
> The "obvious" way of switching to team maintenance of the keyring
> would entail keeping the master copy in a central machine - for
> example on a debian.org box somewhere in a colo. Doing that in a way
> that does not leave the keyring more vulnerable to surreptitious
> compromise than some reasonable persons might prefer, requires
> software support that does not currently exist.
Thanks for the clear explanation, I certainly hadn't heard that argument before.
My first thought would be to simply create multiple keyrings, one for
each keyring maintainer, which are merged on a regular basis. Teaching
the archive scripts to look at more than one keyring wouldn't be too
hard.
Anyway, surely the acceptance onto the keyring is designated by a
signiture on that key, not just by it's presense in a particular file?
How do you ensure the file hasn't been tampered with? Signitures can
be revoked, but only by the person who signed it in the first place.
Anyway, my GPG knowledge isn't that great. so I'll leave it at that.
Thanks for the info.
Reply to: