[gentoo-project] Require OpenPGP signatures from existing devs on new developer applications?

[Kristian Fiskerstrand]

With increasing focus on security in various contexts I'd like to
propose that we start discussing catching up with other distributions
and start requiring new developers' OpenPGP keyblocks to have at least
two signatures from existing developers before applications can be
made[A]. Amongst other things This helps building the Gentoo Web of Trust.


E.g [Debian] has the following requirement: "To maintain the strong Web
of Trust that connects all Debian Developers, Applicants need to
identify themselves by providing an OpenPGP key that is signed by at
least two official Developers. To further ensure their identity,
signatures by other people (who do not need to be DDs, but should be
well connected in the overall Web of Trust) are strongly recommended."


References:

[Debian] https://www.debian.org/devel/join/nm-checklist


Endnotes:

[A] Possibly with an opt-out by application to council, in case there
are certain regions where this is considered non-feasable etc.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3