Re: Web of trust

[Yves-Alexis Perez <corsac () debian org>]

On lun., 2011-04-04 at 16:41 +0200, Nico Golde wrote:
> Ok please use nion () debian org with E1AB DE0E FFCA AEF3 9494 7592 CD4B 2AF3 A0A0 AAAA.
> This key is signed by 73647CFF which is in the Debian keyring and a transition 
> statement signed by 73647CFF as well is online at http://nion.modprobe.de/key-transition-2008-06-01.txt.asc 

Sorry for diverting the thread. I'm not intending to request
subscription to vendor-sec (I'm not yet really active in Debian security
team) but considering the use of GPG, would it make sense to have at
least some kind of “web of trust” thing on the involved keys? That plus
subscribing the project address when possible could help maintaining
some confidence about where the mail really ends (though that doesn't
mean it can't be leaked later).

I'm not sure the procedure Debian use for cross-signing would fit
because it involves physical meeting (and usually beer signing too) and
it might not be practical, but it's still an idea.

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part