OpenPGP Key Signing Policy

Too Long; Didn’t Read

Do you want me to sign your key? Here’s how to do it:

1. You better want to sign my key as well!
2. Meet me somewhere reasonable for tea or a meal and pleasant conversation.
3. Give me a hard copy of your key’s fingerprint and any photo IDs on it.
4. Let me check two of your identity documents. One of them must have your picture.
5. Afterwards, when I’m somewhere I think it’s safe to certify, I’ll sign your key and send it back to you.

Easy enough? If you want more details, you can read all the stuff below.

Preamble

This policy is valid from January 30, 2021, for all signatures made by the GnuPG key:

pub   ed25519/0x1206BA5EDDF2FDF9 2018-04-04 [C] [expires: 2024-05-14]
      Key fingerprint = F4D7 9338 6981 E0AC A9C4  2787 1206 BA5E DDF2 FDF9
uid                   [ultimate] Don San Juan Geronimo <don.geronimo@outlook.com>
uid                   [ultimate] Don San Juan Geronimo <dgeronimo@gmail.com>
uid                   [ultimate] Don San Juan Geronimo <don.geronimo@protonmail.com>
uid                   [ultimate] Don San Juan Geronimo <email@sentamal.in>
uid                   [ultimate] [jpeg image of size 2871]

The most recent version of this key is available from the URL above, by using the Web Key Directory for email@sentamal.in, from the key server at hkps.pool.sks-keyservers.net, or from Keybase.

This policy may be replaced at any time with a new version. If a new version incorporates changes that might affect the strength or perceived strength of the resulting signature, the old version will be linked from the new one.

This policy is signed with the above key and by Keybase. You may download this policy and its signatures for reference and verification.

Version Information and Changelog

This is Version 4.5, written and signed by my key and by Keybase. Updated key expiration dates and photo.

Location

I currently reside in the western suburbs of Chicago, Illinois, United States. However, as a flight attendant, my profession takes me to various places around the continental United States. As such, the easiest way to meet with me to coordinate key verification would be to contact me via e-mail or Keybase to arrange a meeting.

Levels of Signatures

I utilize two certification levels:

• Level 0 (0x10): I will issue this level of signature if I have met the key owner who wishes to obtain a signature to their key from me (hereafter called the “signee”) in person and verified their identity according to the procedure below. Photographic UIDs will be signed at this level if I can still remember the signee’s face during the act of signing. Only signing UIDs at this level helps mitigate the possibility of leaking detailed social connections.
• Level 3 (0x13): This level of signature is reserved only for self signatures.

I do not utilize Level 1 (0x11) or Level 2 (0x12) certification levels.

Keys of Certification Authorities (CAs)

Keys of CAs are keys owned by a whole organization and not by an individual. Usually the fingerprints of those keys have to be verified by getting them from the corresponding website of the CA and cannot be checked by the Identity Verification procedures described below. If a viable procedure for verifying the ‘identity’ of a CA’s keys is made known to me, I will add procedures for keys of CAs to the Identity Verification section. Until then, I will not sign keys owned by CAs.

Prerequisites for Signing

Identity Verification

The signee must prove their identity to me by way of a national ID card, a driver’s license, or a similar identity document. The identity document must feature a photographic picture of the signee. This also implies that the signee’s key must feature their real name.

In addition, the signee must provide a secondary form of identification that includes their name, with or without a picture. Acceptable examples include, but are not limited to, a business card, a conference badge, a credit card, or an additional identity document as defined in the last paragraph.

Hardcopy of Fingerprint

The signee should have prepared a printout of the output of gpg --fingerprint for their key (or the equivalent command of their OpenPGP client). I will keep this copy for reference.

A hand-written sheet featuring the key ID, the fingerprint, and all user IDs the signee wishes to obtain a signature to will also be accepted.

If the signee wishes to obtain a signature to a photographic user ID, the printout should contain the image of that photographic user ID. A printout or photocopy of a photo clearly showing the same person as in the photographic user ID will also be accepted.

Miscellaneous

• The above must take place under reasonable circumstances, i.e. at a calm place, both parties not being in a hurry, etc.
• The signee should make their public key available on a publicly accessible pgp.net keyserver, such as hkps.pool.sks-keyservers.net, through Web Key Directory, or through Keybase.
• The signee should be willing to cross-sign with me.

The Act of Signing

Fingerprint Verification

At a secure location I will verify the key’s fingerprint using the hardcopy of the fingerprint that has been given to me.

E-Mail Verification

After successful fingerprint verification, I will sign all user IDs which I was asked to sign. Each signature is then individually sent to the email address listed in the corresponding user ID, enciphered to the signee’s key.

As only the signee can decipher and thus publish the signatures, it is warranted that the email addresses listed in each user ID with a published signature belongs to the signee.