Re: [openpgp] To bind or not to bind

[Heiko Schäfer <[e-mail]>]

Hello List,

On 4/2/24 09:56, Aron Wussler wrote:
> I can't see the irreparable damage that you're referring to. Making a
> key that a few implementations can't parse IMO offers the same friction
> than having an expired old key around, and having to distribute a new
> one to the contacts still using the old one.
>
> On the other hand, I think the argument "whatever is compatible with PQC
>   should also be compatible with V6" is a valid one - and this may boil
> down to Kai's point, that they're not ready to move to V6.
>
> I agree that adding a V4 PQC key is a bit of a dirty hack, but mandating
>   their refusal may be a too hard solution.

I agree with Aaron.

I have also not been convinced by the arguments against allowing the 
combination of PQC encryption with v4 keys.
As I see it, only allowing PQC encryption in combination with v6 keys is 
not the best trade-off.

Sure, there are risks and downsides to specifying PQC encryption subkeys 
on v4 keys/certificates.
But there are also risks and downsides to the alternative approach of 
specifying PQC encryption exclusively for v6 keys.

Heiko