Signed objects

# Signed objects for IPFS

In my experience with getting public key signage to work over IPFS, there are two categories of signed object.

## Small signed objects

An IPFS app will likely store its data model in IPFS. It will also use IPFS to share data with other app instances. This will likely be stuff that user's don't really care about, such as, objects on a wire.

For example, my project maintains its own keystore to sign IPFS paths before sending the data over pubsub to other peers. A peer can sign the link to say "Yes, this is a good link" and if you trust any of those peers (e.g. you have their public key), you'll download the data from the link.

- [Index structure](https://github.com/johnny-morrice/godless/blob/master/crdt/index.go)
- [MakeLinkMessage(Link)](https://github.com/johnny-morrice/godless/blob/master/crdt/address.go#L109)

What would be really nice here would be if we could send such objects by pubsub without doing all the manual encoding as per `MakeLinkMessage(Link)` above.

I call these "Small" signed objects, not because I expected them to be tiny, just because I expect them to occupy less of the user's mindspace than the "Big" signed objects described next.

## Big signed objects

A big signed object, is say, a program file from another user and you really want to make sure it is definitely from that person. Today, when someone wants to do this, they have the developer of the program sign her binary using PGP. Then they can download the certificate and verify it via PGP.

I'm aware that kinda the whole point of IPFS is that it's a permanent store, and that paths are generated from crypto signatures, but I really think supporting additional signing schemes would be a great feature for this use case. IPFS based apps would have much less friction operating with current systems that use PGP for instance.

Here's an example: the user downloads an Ubuntu package from IPFS, and IPFS looks up additional signatures stored alongside the package, and dumps out the PGP sig. The user can then verify that the file is from the Ubuntu developers, using the keys that are contained in their keyring by default. Edit: or I suppose the point of an integration would be that IPFS could do that logic itself.

There is also a useability issue if an app needs to use an existing key signing mechanism. Currently that means the user needs IPFS keys, and the other type of key. If IPFS can only support its own custom crypto keys, then that means the user must use IPFS keys and so have yet another private keyring to keep tabs on. Much better if they had the option to load in their existing keyring.