validation of sigatures.

We need to review and document how signatures are used.

One pending questions is how does a third party we share a lockbox with validate the signatures.

The exchanges server currently sends a key one way.
If we want to provide a friend with access to a lockbox we ask them to publish their key..

The issue is that if they want to validate any lockbox we send them, then they also need our signing key.
The same goes if we receive a lockbox from them.

So we need to ensure when keys are exchnaged that we also get public signing key.

Can we/should we als make the exchange two way so we supply our keys as part of the exchange.
This can be done now by both parties 'publishing' their keys but two separate actions are required and a more seamless process would be better. There is a question about profiles here - when exchanging keys (if we do it automatically) who do we specify the profile to use, or do we just send them all?

Start by tracing the exchanges server's current one-way key exchange and the existing publish-key actions. Document how a third party validates lockbox signatures, then clarify whether the exchange should become two-way and how profiles should be selected when keys are exchanged. Done means the key requirements and exchange behavior are specified clearly.