New keyserver at keys.openpgp.org - what's your take?

[Andrew Gallagher]

On 02/07/2019 13:06, Michał Górny via Gnupg-users wrote:
> In Gentoo we're using a CA-like model with a central service signing
> UIDs of all developers.  It is *convenient* for it to be able to inject
> those signatures into keys of the developers, and distribute them along
> with them.

It is convenient, but if it is covenient for you to attach one signature
to the keys of your developers and redistribute, then it is convenient
for an arbitrary person to attach a million sigs and gum up the system.
I think this is one case where convenience will have to be sacrificed no
matter what solution we adopt.

This could be a use case for the "preferred keyserver" extension. If you
ran your own keyserver and your developers set it as their preferred
keyserver, then they would be publicly stating "Allow Gentoo to attach
signatures without my explicit permisson, but distrust everyone else".
This would only have to be done once in advance, and it could be made
part of your new developer onboarding process.

-- 
Andrew Gallagher

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20190702/82020925/attachment.sig>