Gentoo Archives: gentoo-project

From: "Michał Górny" <mgorny@g.o>
To: Rich Freeman <rich0@g.o>
Cc: gentoo-project@l.g.o
Subject: Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?
Date: Fri, 06 Jan 2017 18:49:00
Message-Id: 20170106194850.4cb45657.mgorny@gentoo.org
In Reply to: Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications? by Rich Freeman
1 On Fri, 6 Jan 2017 11:15:17 -0500
2 Rich Freeman <rich0@g.o> wrote:
3
4 > On Fri, Jan 6, 2017 at 1:34 AM, Kent Fredric <kentnl@g.o> wrote:
5 > >
6 > > This seems like a very obvious and easy utility to provide, I'm just
7 > > surprised I don't know of any such service.
8 > >
9 >
10 > As was pointed out, some CAs might offer these kinds of services, but
11 > I don't think any of the standard classes really apply to rigorous
12 > identify verification of individuals (just organizations).
13 >
14 > A notary public is probably the more traditional route. I believe you
15 > can give somebody a template document that basically includes a
16 > statement by a notary that somebody has appeared in person showing
17 > proof of identity for the information contained in the statement.
18 >
19 > Of course, that then leaves you with having to verify the authenticity
20 > of the notary seal/etc, and it will tend to involve sending around
21 > physical documents unless you just want a scan (which isn't ideal from
22 > an authentication standpoint).
23
24 Wasn't it the notary route that caused CAcert never to be widely
25 accepted as a CA? I think they removed that when they started
26 the auditing process.
27
28 --
29 Best regards,
30 Michał Górny
31 <http://dev.gentoo.org/~mgorny/>