keybase / keybase/keybase-issues

Optionally change GPG's trust/validity

Open
#223 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

In #220, we discussed how/when Keybase should change GPG's perception of key-validity or trust. There was consensus that it should not, at least not by default. This issue is about a hypothetical option to do just that.

What happens if a user wants Keybase to determine that keys are marginally or fully valid based on social-media &c. proofs?

In #220, I wrote:

> One kludge I like is making a local certification key. Make a new keyring in
> `.keybase` and add a phony key which is just used for generating non-exportable
> certifications. Set the trust-level of that key to whatever the user decided they
> wanted Keybase to count for. When the user decides to track someone, use that
> phony key generate a non-exportable certification on the key in question.

If Keybase implements validity infuence, this should be the mechanism. This is such a geeky, tricky feature that a user wants to turn this on should probably edit a Keybase conf file to do so.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing issue #220 and the proposed `.keybase` keyring approach for non-exportable certifications. Clarify the configuration, trust-level choices, and how social-media proofs should affect GPG validity. Done means a decided design for the opt-in behavior, not merely an implementation sketch.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.