Prove email / OpenPGP uids?

uids are arbitrary strings, but are most frequently represented as RFC 2822 style email addresses.

One common non-exploit is to create a totally bogus UUID such as [president@whitehouse.gov](http://pool.sks-keyservers.net:11371/pks/lookup?search=president%40whitehouse.gov&op=index&fingerprint=on) that the key owner actually doesn't control.

A more sophisticated attack is to get someone to sign off on your key for another UID (or in the case of keybase.io a github/twitter/whatever account) and then GPG will trust the key for other UIDs, such as billg@microsoft.com.

Since keybase.io is already doing email verifications, it would be nice if there could be some mechanism to prove that a that a user controls an email, similar to what the [PGP Global Directory](https://keyserver.pgp.com/vkd/GetWelcomeScreen.event) does.

Start by reviewing the issue's examples of bogus email UIDs and cross-UID signatures, then compare the proposed flow with the linked PGP Global Directory and Keybase's existing email verifications. Define what control of an email UID must prove and how that proof should affect trust; no repository files or tests are identified in the issue.

Written by the indexing model from the issue text.