A Directory Of People And Their Keys: Verified By Me First, Then By Each Other, And A Link That Only Counts When It Goes Both Ways

Summary

The article the build brief came with, in Dinis Cruz's voice: why he wanted a place to publish people's public keys from the start and got stuck, why now (sgit is moving to public-key cryptography, and its documentation names the missing directory), what does exist (GitHub's key URLs, keys.openpgp.org, Keybase, Keyoxide) and what does not (a web of trust that works), and the workflow from a passkey to a message, with the two-way rule as the answer to 2019.

Key concepts

• The brief — the build order and the tests
• The failure — the 2019 keyserver flood the two-way rule answers
• The four rules — rule 1 is what makes a two-way link safe

Key ideas

• There are places to publish keys; what is missing is the combination.
• A vouch nobody confirmed is visible as a claim in the voucher's record, and adds nothing to the other person.
• The invitation is a QR code with the URL printed above it, which has worked well in person.

On this site

The article behind people/ and the v0.2.0 release.

Read the document