In message <200502071721.05162.mark(a)mcs.vuw.ac.nz>, Mark Davies writes:
>So from the key signing party we should be in the position that for anyone we
>have verified we are happy that the pgp key we have the fingerprint for is
>indeed for the person we met but the one thing that the process hasn't done
>is confirm that all the email addresses listed in the key are under the
>control of that person.
>
>To achieve this last step here is a process (lifted from the NetBSD developers
>PGP guidelines): [...]
I agree that the "keysigning" party approach generally bypasses
actually confirming the email addresses really belong to the person in
control of the key. (Which is unfortunate as the email address tends to
be one of the more trusted parts.)
The usual approach I've seen to confirm that the email address is correct
is to send the signed key to the email address listed, encrypted with
the key. And not upload the key/signature to a key server. That way
only the person in control of both the email address (used) and the key
is able to gain access to the signature, and it's not visible to anyone
else until they've done so.
The NetBSD approach seems to go further and confirm all the uids,
providing one follows the elaborate process of tracking each "challenge"
that is sent out against the particular uid it belongs to. But I'm not
sure it's always necessary if one only signs uids one has other reasons
to know are associated with the person in question. (I generally avoid
signing uids for which I don't recognise the email address, for
instance, unless it's the one to which the key is being sent.)
As it happens I've already seen half a dozen new signatures for my key
uploaded to the keyservers and not emailed to me, so those people
presumably trust the email address for other reasons.
Ewen
