Migrating keys (fwd)

[David Shaw]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Nov 27, 2003 at 10:27:06PM -0800, Atom 'Smasher' wrote:
> > No.  When you sign a key, you sign the primary, and you sign a user
> > ID.  You do not sign a subkey, and thus you are not making a statement
> > in any way, shape, or form about the number, quality, or otherwise of
> > the subkeys.  Don't read too much into what a key signature means.
> > Key signatures have exactly nothing to do with subkeys.
> ===============================
> 
> i'm not trying to say that signing someone else's key is a certification
> that their sub-key(s) are authentic (i'm actually trying to point out
> where that common assumption breaks down), but it's generally considered
> to be the case, and the current trust model doesn't complain when that
> assumption is made.... in fact, the current trust model helps people feel
> comfortable making that [false] assumption.
> 
> although a 3rd party signature really does bear no relationship to the sub
> key(s), most of us consider it convenient to think that it does.

Don't.

I've never met anyone who believed this, but rather than spending a
lot of time and effort to try and change the standard to remove
something that is a significant *feature* of the standard.... why not
just accept how things actually work?

David
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.5-cvs (GNU/Linux)
Comment: Key available at http://www.jabberwocky.com/david/keys.asc

iHEEARECADEFAj/HbPAqGGh0dHA6Ly93d3cuamFiYmVyd29ja3kuY29tL2Rhdmlk
L2tleXMuYXNjAAoJEOJmXIdJ4cvJcUsAniXnC21LOF5GzOBgjO287Q3UoLBDAJ9t
GTsNvwDp2xU1jCqVC2sVLGrN8A==
=dJwt
-----END PGP SIGNATURE-----