> I suppose there might be some situations where that is helpful. But it sounds
> dangerous as a default behaviour. Old keys would never get retired / revoked.
> This could leave users vulnerable to attack. Otherwise, what's the point of
> rotating keys?
I see. If I understand you correctly, you're suggesting that the old component
would be dropped. Are you suggesting that people resign their old messages
when they retire an signing subkey (that sounds like a lot of work)? If not,
how would a third party verify an old signature?
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/2577#issuecomment-1646649532
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/issues/2577/1646649...@github.com>
_______________________________________________
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint
