deleting signatures from uids

Peter S. May me at
Thu Nov 2 23:01:12 CET 2006

Hash: SHA1

Alex L. Mauer wrote:
> Peter S. May wrote:
>> I would think that it's important for keyservers to widely distribute
>> the revocation certificates of revoked signatures.  
> Agreed.  But it's not important to distribute signatures that have been
> revoked.
>> If the keyservers
>> simply omitted revoked signatures from search results, how would a
>> client know that this uid was revoked?  
> Because the server could, and presumably would, still distribute
> revocation signatures, but not the signatures they revoke.

Yeah.  Posted before thinking.  The revocations are still good without
the uids themselves.

>> Stripping data that isn't
>> particularly useful is a job better left to the client.
> I disagree.  Downloading the data only to discard it is a waste of time
> and bandwidth.

Again, such is true for the uids themselves.  But revocations for uids
that the client doesn't have might or might not be considered
superfluous.  Perhaps we find a revocation for a uid we don't have yet
on one keyserver and discard it, then find that uid still available on
another keyserver, not yet revoked.  I have no idea how that's handled.
 None whatsoever.

Version: GnuPG v1.4.2.2 (GNU/Linux)
Comment: Using GnuPG with Mozilla -


More information about the Gnupg-users mailing list