> > * The key should be signed by some central instance for automated > > validity check. > > > > Here things get hairy. How about having recruiter/infra team sign a dev's > > key on completion of the recruitment process? Just a first thought... > > I think this is an important requirement however it's quite difficult > to conduct reliably. A normal keysigning process usually requires > knowing one personally (and perhaps verifying fingerprints over a > phone with voice verification), seeing one's ID personally and the > like. This is probably unfeasible in the Gentoo development > environment (I'm not a dev, though, so I'm just guessing).
Well, as long as the signed UID is the specific "Gentoo address UID", this should be no problem, since... * the signature proves the key belongs to the e-mail address, nothing else * the e-mail address is given to the owner of the key during recruitment Meaning nobody is certifying something that he/she does not know already by definition. Please point out any thinkos... :) -- Andreas K. Huettel Gentoo Linux developer dilfri...@gentoo.org http://www.akhuettel.de/
signature.asc
Description: This is a digitally signed message part.
