On 09/09/2008, David Shaw <dshaw(a)jabberwocky.com> wrote:
I'm one of the GnuPG developers, and as such, a copy of my key
is in
/usr/share/doc/gnupg-1.4.x/samplekeys.asc on any system that has
gnupg-1.4 installed. It's a key that many (most?) Fedora users
already have, and had before this current problem even started. This
doesn't mean people should necessarily trust my key, of course, but it
does serve as a pretty effective pre-distributed key that can be
leveraged for this as its very wide distribution would make it
difficult to replace out from under someone without the mischief being
very visible (much the same argument that also holds for the new
package signing key, of course, except that my key is already widely
distributed).
As luck has it, I work around half an hour away from the Red Hat
Massachusetts office.
Now that, seems like a really good idea :o)
How about you sign, e.g. Jesse's key (if he's willing)?
David
Bill