Aminda Suomalainen ⚧ dee1fc50d6 | ||
---|---|---|
friends | ||
privacytools | ||
software | ||
README.md |
README.md
pgp-alt-wot
PGP keys signed by me so I don't have to validate the same keys again-and-again and can just trust my own paper verified fingerprint in the subsequent validations.
WoT? Web Of Trust
Example use case for this repository is Tor Browser, I need to download it on most of systems and I need to verify it and it's painful to verify the PGP key all the time, while I can just verify my own fingerprint from paper and see that it has signed the keys. I have done this at least twice on Windowses first installing GPG through Chocolatey.
I don't know if there is point in putting down formal signing requirements, but what has been my policy at the time of writing is:
NOTE: this section is written from memory so may be inaccurate
- friends - knowing for a long time through various connections and seeing at times seeing IDs (or visiting both directions) and otherwise having so deep relationship that lying about identity wouldn't be easily possible
- privacytools - confirmed from the people themselves, their websites, privacytools.io (WKD in git) and similar.
- software - used their verification instructions (of varying strength)
- keepassxc.asc mullvad.asc tails.asc tor-browser-developers.asc yggdrasil.asc
- keepassxc - checked their website through normal and Tor Browser
- mullvad - checked their website and onion
- tails - followed their verification instructions (including checking that it's signed by a Debian developer)
- tor-browser - followed their checking instructions
- yggdrasil - checked their website and comitted apt repo adding to git
TODO:
- add links to the previous section
- add OnionShare?