On 01/17/2018 01:20 AM, Daniel Kahn Gillmor wrote: > On Tue 2018-01-16 22:56:58 +0100, Kristian Fiskerstrand wrote: >> thanks for this post Daniel, my primary question would be what advantage >> is gained by this verification being done by an arbitrary third party >> rather by a trusted client running locally, which is the current modus >> operandus. Any keyserver action doing this would just shift >> responsibilities to a third party for something better served (and >> already happens) locally. > > the advantage is spam-abatement -- the keyservers have to keep track of > what is attached to each blob they transport/persist. if all signatures > that they transport for a given blob are cryptographically certified, > then only the original uploader of that blob can make assertions about > it; other people can't spam the blob to make it untransportable.
All the certificates used in trollwot are technically correct. You can still use the same mechanisms as you control the other key material, and can use intentionally weak key material if wanting to speed things up. -- ---------------------------- Kristian Fiskerstrand Blog: https://blog.sumptuouscapital.com Twitter: @krifisk ---------------------------- Public OpenPGP keyblock at hkp://pool.sks-keyservers.net fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3 ---------------------------- "We all die. The goal isn't to live forever, the goal is to create something that will." (Chuck Palahniuk)
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
