[openpgp] Re: What have we created?

[Arturo 'Buanzo' Busleiman <[e-mail]>]

Hello everyone, I hope this email finds you well. I agree that
implementations should be free to abstract certificate topology from end
users. However, that abstraction must not conceal security-relevant changes
in trust, identity equivalence, or key selection. Any thoughts on
establishing normative, testable requirements across HKP, Key Replacement,
and SOP for these transitions... or not?

Cheers,

-- Buanzo


On Wed, 14 Oct 2026 at 06:18, Daniel Huigens <d.huigens=
[e-mail]> wrote:

> On Wednesday, October 14th, 2026 at 11:04, Andrew Gallagher wrote:
> > Agreed! But the other side of that coin is that if people have been
> > relying on that lack of semantics, it can be a breaking change to
> > retrospectively supply semantics for them. In this case, people have
> > been passing around "keyrings" consisting of multiple TPKs belonging to
> > arbitrary people for decades -- so we can't easily say now that
> > concatenating TPKs into a single file implies that they belong to the
> > same person, when the inverse assumption has been true since forever.
>
> Yeah, that's fair. But I think we should then keep using existing terms
> (such as "keyring", although it's quite vague, or "sequence of TPKs")
> for the existing concept, so that we only need a new term for the
> new concept? That way the new term also signals that it's a new thing,
> so to speak.
>
> And then in that terminology, indeed not every sequence of TPKs is
> automatically a certificate bundle, if they don't belong together.
>
> -- Daniel
>
> _______________________________________________
> openpgp mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>