Ryan Hurst via dev-security-policy <[email protected]> writes:
>My first thought is by using SPKI you have limited the service unnecessarily >to X.509 related keys, I imagined something like this covering PGP, JWT as >well as other formats. It would be nice to see the scope increased >accordingly. You can't do it for PGP, that hashes in a pile of additional stuff unrelated to the key so there's no way to uniquely identify a specific key, only "the key and this specific set of metadata". Using the SPKI for the hash is the best option, I use that internally as the unique ID for keys, including PGP ones. Peter. _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
