Re: Migrating to GPG - A mini-HOWTO

[Philip Hands <phil@hands.com>]

Paul Slootman <paul@wau.mis.ah.nl> writes:

> How do you prove to whoever is able to erase the package that you
> are who you say you are? I.e. how do you convince them that they
> should in fact erase the package? 

You do that by sending them a message signed with a new key, that you
have had signed by someone else.  As long as people don't adopt the
``I'll sign anything you like, once I've met you once'' attitude, this
works.

To address the ``If you trust it for anything, you should trust it for
everything'' argument, lets try to draw an analogy in the real world:

  Lets say you are a bank manager, and you have a list of all your
  customer's signatures (which are difficult to forge).

  Customer A sends you a signed letter, instructing you to transfer
  100.00 to another person's account.

  Customer B mails you a signed letter saying that they have had
  plastic surgery, and changed their name, and not only do they want
  you to transfer all future control of the account into this new
  name, but they also want you to sign an affidavit saying that you're
  sure that these two names apply to the same person.

  I think you're quite likely to do as requested by ``A'', but will
  request that customer B come in, in person, with all required
  documentation to prove their claims, before doing what they asked.

If any of the people reading this treat key signing any less seriously
than signing such an affidavit, then please speak up so that the rest
of us can tell PGP/GPG that your signatures are proof of nothing much.

Cheers, Phil.