Gentoo Archives: gentoo-project

From: Rich Freeman <rich0@g.o>
To: gentoo-project@l.g.o
Subject: Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?
Date: Fri, 06 Jan 2017 16:15:20
Message-Id: CAGfcS_nW49oXL23TOqPcN4Mm+aTTX4LNh8OesXiMMdpe6s22UQ@mail.gmail.com
In Reply to: Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications? by Kent Fredric
1 On Fri, Jan 6, 2017 at 1:34 AM, Kent Fredric <kentnl@g.o> wrote:
2 >
3 > This seems like a very obvious and easy utility to provide, I'm just
4 > surprised I don't know of any such service.
5 >
6
7 As was pointed out, some CAs might offer these kinds of services, but
8 I don't think any of the standard classes really apply to rigorous
9 identify verification of individuals (just organizations).
10
11 A notary public is probably the more traditional route. I believe you
12 can give somebody a template document that basically includes a
13 statement by a notary that somebody has appeared in person showing
14 proof of identity for the information contained in the statement.
15
16 Of course, that then leaves you with having to verify the authenticity
17 of the notary seal/etc, and it will tend to involve sending around
18 physical documents unless you just want a scan (which isn't ideal from
19 an authentication standpoint).
20
21 Forging a notary seal is probably a very big deal in most countries,
22 so that is probably a deterrence to fraud, and showing a false ID to a
23 notary public is almost certainly a crime as I believe it is
24 considered equivalent in many cases to making a statement in court.
25
26 For Asia I'm not intimately familiar with the process but I think
27 there are organizations that will certify the validity of a chop (a
28 seal used for the same purpose as a western signature), which is also
29 a form of identity verification. Somebody else could certainly
30 elaborate here and dispel any ignorance in that statement.
31
32 --
33 Rich

Replies