Revoking a certificate (--edit-key + revsig)

[Daniel Kahn Gillmor]

On Fri 2017-06-16 10:06:38 +0300, Teemu Likonen wrote:
> My question is simple (kind of): In what situations would you revoke a
> certificate that you have made on someone else's key? (Technically:
> --edit-key + revsig.)

That action would be me saying "i no longer believe that this key is
only controlled by the entity that corresponds to the identity in the
User ID"

in the abstract:

 * i learned via some channel i consider trustworthy that this key isn't
   appropriate for use with this User ID any more.

more concretely:

 * "I had lunch with Sarah and she told me she'd lost access to her
   secret key and didn't have a revocation certificate available."

or

 * "Acme Corp. just published a press release on their https website
   indicating that there was a break-in on their server "astrid".  I
   happen to know that the user account "archivemaster" on "astrid" has
   a copy of their software-signing secret keys, but they haven't
   revoked them publicly.  I no longer have confidence that this key is
   controlled solely by Acme Corp, so i'm removing my public attestation
   of it."

Does this make sense?  From the point of view of the person evaluating
the third-party signature, they can't tell the difference.  they just
know that before they saw the revocation, they know that "dkg says this
key belongs to Sarah" or "dkg says that this is Acme Corp's
software-signing key", and after they see the revocation, they know "dkg
doesn't have anything useful to say about the identities on this key --
they could belong to anyone".

hth,

     --dkg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 832 bytes
Desc: not available
URL: </pipermail/attachments/20170621/d58465ae/attachment.sig>