keybase / keybase/keybase-issues
Optionally change GPG's trust/validity
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
In #220, we discussed how/when Keybase should change GPG's perception of key-validity or trust. There was consensus that it should not, at least not by default. This issue is about a hypothetical option to do just that.
What happens if a user wants Keybase to determine that keys are marginally or fully valid based on social-media &c. proofs?
In #220, I wrote:
> One kludge I like is making a local certification key. Make a new keyring in
> `.keybase` and add a phony key which is just used for generating non-exportable
> certifications. Set the trust-level of that key to whatever the user decided they
> wanted Keybase to count for. When the user decides to track someone, use that
> phony key generate a non-exportable certification on the key in question.
If Keybase implements validity infuence, this should be the mechanism. This is such a geeky, tricky feature that a user wants to turn this on should probably edit a Keybase conf file to do so.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing issue #220 and the proposed `.keybase` keyring approach for non-exportable certifications. Clarify the configuration, trust-level choices, and how social-media proofs should affect GPG validity. Done means a decided design for the opt-in behavior, not merely an implementation sketch.
Written by the indexing model from the issue text.
Assessment
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100