[openpgp] Key and Certificate Management in SOP

[Daniel Kahn Gillmor <[e-mail]>]

Hey OpenPGP folks--

I'm preparing to add four new subcommands for OpenPGP Key and
Certificate Management to the Stateless OpenPGP API:

   sop update-keys      (keep an OpenPGP secret key "up-to-date")
   sop merge-certs      (merge OpenPGP certificates that share primary keys)

   sop certify          (certify a User ID in a cert)
   sop validate-certs   (verify a User ID-to-cert binding)

The changes are pending in git right now, on the main branch, and i
welcome feedback on them from implementers and from potential users of
the sop interface.

   https://gitlab.com/dkg/openpgp-stateless-cli

You can see the "editor's copy" here:

   https://dkg.gitlab.io/openpgp-stateless-cli/

"sop update-keys" should generally keep a secret key "alive" so that you
can use "sop extract-cert" to get a "fresh" certificate going forward.
it leaves quite a bit of leeway to implementers, which i hope will help
us surface best practices across implementations.

"sop merge-certs" should be pretty straightforward: you've got an
OpenPGP cert, which might have some updates.  You find another copy of
the same cert somewhere else, which might have different updates, and
you want the consolidation of all the updates.

And I've tried to model "sop certify" and "sop validate-certs" on "sop
sign" and "sop verify".


 ----

As usual, my goal is to present a minimally useful interface initially,
one that can be directly used and tested against in the interoperability
test suite.

I'm planning to publish a new revision of the draft within the next week
(the latest version recently expired, whoops).  If you've got feedback
on these changes (or if you want to get any other reasonable changes in
before i publish the new draft, please open gitlab issues or reply
on-list.

Happy hacking,

        --dkg