On Thu, Jul 23, 2015 at 9:12 AM, Werner Koch <wk(_at_)gnupg(_dot_)org> wrote:
On Tue, 21 Jul 2015 23:11, dkg(_at_)fifthhorseman(_dot_)net said:
So the question is whether having this as an advisory mechanism (not a
perfect bulwark against adversarial publication) is worthwhile. If it
I would really like to see such a standard flag. For whatever reasons
some people do not like to have there keys on a keyserver and only make
them available by other means. Such a flag would also help with testing
to avoid accidental uploads of a key.
A related flag, though sadly more complex to implement, would be
making it so the list of signatures on a key must be signed by a
selected subkey.
This would prevent an irritating attack where people create random and
sometimes harassing or offensive keyids and use them to sign your key
and upload the result to the keyservers-- which is one of the most
common reasons I've seen cited for people not wanting their keys on
keyservers.
_______________________________________________
openpgp mailing list
openpgp(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/openpgp