On: Git-signatures – Multiple PGP signatures for your commits

[fwip]

keybase.io is a really solid approach for trusting that a given key is owned by a certain person. Basically, it's a centralized registry to list your keys, and you can publish proof of key-ownership on any website/social media that you own. So anyone can look up my public key from my twitter or github, and know that they're both me.

Some people object to it because it lets you store your keys with them (encrypted with a passphrase), but that's always been optional.

[angry_octet → fwip]

Extra requirements: - Not trusting one company/hosting provider (like keybase/AWS).

- Works for periodically or totally offline signing and verification.

- Not be an ephemeral record (like a tweet) or undated. - Not require memorisation of very long passphrases.

- Not be subject to mass compromise (i.e. like a bug in a Bitcoin wallet code on android).