Re: [saag] IETF 93 Agenda Request - Key Discovery

["John R Levine" <[e-mail]>]

> needs to be the REMOTE MTA.  If it reaches that remote MTA through its
> local MTA, that's a problem, since now either (1) the MUA has to trust
> the local MTA for all of its keys or (2) the remote MTA needs to sign
> its address/key bindings.  Both of which are gross.

Yes, but webfinger is just as bad.

One of my clients is an ad agency in Montreal.  I host their mail at 
Tucows, their web site is at some hosting provider in Toronto with whom I 
have had no contact beyond what's needed to point A records at them.  It 
is not unusual for a domain's mail and web to be handed this separately.

If it were easy to use encrypted e-mail, I expect they would, e.g., mail 
to a client about a campaign for an unannounced product.

So where do you do your webfingering for say, [e-mail]?  It's not 
going to be https://flacks.biz, they don't know anything about the mail. 
So you need some way to publish the location of the server, presumably a 
SRV record.  Even if you assume that an MUA behind a corporate firewall 
won't filter out SRV record requests, unless you believe in DNSSEC 
everywhere, you can't trust the SRV more than anything else, so the 
responses from webfinger need to be signed just like the ones from the MTA 
do.

I presume JOSE is the way to do that, but you'd know better than I would.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.