Re: [gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Kent Fredric]

On Thu, 5 Jan 2017 17:39:49 -0500
Yury German <blueknight@g.o> wrote:

> I think that we need Authentication of who the people are. Personal
> opinion but a scan or a picture of a legal document (Passport /
> Driving License / Birth Certificate) with the official numbers
> blanked out should be part of the recruitment process

I thought of that myself, but quickly realised that approach doesn't
really add much value.

Mostly because ID's as such are easily faked in a digital medium,
especially as there's no way for somebody on Gentoo staff to know what
to expect from say, a New Zealand Photo ID, and what aspects of those
ID's need to be present for the ID to be considered legitimate.

Especially as some of those elements that exist on physical ID to
prevent fraud don't translate into digital form, like:

- Transparent Sections
- Holographic Foils
- Embedded chips

It would be reasonably straight forward to create a hawaii ID McLovin
style for Bugs, and nobody would be able to verify its authenticity. 

What I think is needed here is some broader platform outside the
context of simply Gentoo, who acts as local providers of digital
authenticity checks.

For example, if there was some organisation unaffiliated with Gentoo
who operated in New Zealand, and that organisation was themselves
reputable, I'd be much better off getting them to physically
authenticate my identity, by physically showing them my Photo ID,
letting them look for the identifying marks that indicate authenticity,
and then providing me with a digital proof of identity by signing my
key for me.

This way Gentoo are not reliant on trusting me not to be good at faking
my ID, but are instead relying on the reputation of the authenticating
agency.

This seems like a very obvious and easy utility to provide, I'm just
surprised I don't know of any such service.