<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><div dir="ltr">On Aug 15, 2019, at 3:33 PM, Werner Koch <<a href="mailto:wk@gnupg.org">wk@gnupg.org</a>> wrote:<br><br></div><blockquote type="cite"><div dir="ltr"><span>On Thu, 15 Aug 2019 00:02, <a href="mailto:gnupg-users@gnupg.org">gnupg-users@gnupg.org</a> said:</span><br><span></span><br><blockquote type="cite"><span>But at least then we will want to add cryptography to see which</span><br></blockquote><blockquote type="cite"><span>selfsigs are truly legitimate, right?</span><br></blockquote><span></span><br><span>That would be the first and most important step to get the keyservers</span><br><span>back for the WoT</span><br></div></blockquote><br></div><div><span style="background-color: rgba(255, 255, 255, 0);">Actually, I think hockeypuck might be validating selfsigs already:</span><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);"> <a href="https://github.com/hockeypuck/openpgp/blob/v1/pubkey.go">https://github.com/hockeypuck/openpgp/blob/v1/pubkey.go</a></span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">when it calls CheckSig().</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">(It isn’t that hard to install and loads most of the SKS keydump keys, but you do need PostgreSQL and then to sync with SKS to get the remaining (malformed) keys that apparently didn’t get imported from the dump.)<br><br></span><div dir="ltr"><span style="background-color: rgba(255, 255, 255, 0);">Sent from my iPad</span></div></div></div></body></html>