OpenPGP Key Signing Policy

Too Long; Didn't Read

Do you want me to sign your key? Here's how to do it:

  1. You better want to sign my key as well!
  2. Meet me somewhere reasonable for tea or a meal and pleasant conversation.
  3. Give me a hard copy of your key's fingerprint and any photo IDs on it.
  4. Let me check two of your identity documents. One of them must have your picture.
  5. Afterwards, when I'm somewhere I think it's safe to certify, I'll sign your key and send it back to you.

Easy enough? If you want more details, you can read all the stuff below.

Preamble

This policy is valid from for all signatures made by the GnuPG key:

pub   ed25519/0x1206BA5EDDF2FDF9 2018-04-04 [SC] [expires: 2021-05-04]
      Key fingerprint = F4D7 9338 6981 E0AC A9C4  2787 1206 BA5E DDF2 FDF9
uid                   [ultimate] Don San Juan Geronimo <don.geronimo@outlook.com>
uid                   [ultimate] Don San Juan Geronimo <dgeronimo@gmail.com>
uid                   [ultimate] [jpeg image of size 2890]
uid                   [ultimate] Don San Juan Geronimo <don.geronimo@protonmail.com>
uid                   [ultimate] Don San Juan Geronimo <email@sentamal.in>

Photo UID

The most recent version of this key is available from the URL above, by using the Web Key Directory for email@sentamal.in, from the key server at hkps.pool.sks-keyservers.net, or from Keybase.

This policy may be replaced at any time with a new version. If a new version incorporates changes that might affect the strength or perceived strength of the resulting signature, the old version will be linked from the new one.

This policy is signed with the above key and by Keybase. You may download this policy and its signatures for reference and verification.

Version Information and Changelog

This is Version 4.4, written and signed by my key and by Keybase. Removed 'Transition To New Key' section. Removed subkeys from the fingerprint above. Removed 'About keybase.io' section. Formatted to HTML.

Previous Versions
  • Version 4.3, written and signed . Removed 'themindfulworkflow.com' e-mail.
  • Version 4.2, written and signed . Removed RSA encryption subkey. Added Protonmail e-mail as a UID. Removed section 'Temporary Revisions.'
  • Version 4.1, written and signed . Removed subkeys from key material that will no longer be used.
  • Version 4.0, written and signed . Added explanation about temporary revisions in Version Information and Changelog. Changed Levels of Signatures to only use Level 0 for certifying keys and user IDs and Level 3 for self-signatures to generalize potential social graphs. Updated Transition section to signify completion of transition. Minor word edits. Updated key expiration dates.
  • Version 3.1, written and signed . Added additional signing and authentication subkeys to my public key material. Added TLDR section.
  • Version 3.0, written and signed . Transition to using ECC key as the primary key in use. Added transition section with links to the transition statement. Revoked previous encryption subkey and added on, in this order, an RSA encryption subkey (for compatibility) and a CV25519 encryption subkey (which will be utilized first before the RSA key). Removed key expiration date.
  • Version 2.0, written and signed . Transitioned all links from OneDrive to keybase.io. Added 'keybase.io' as an additional place that will count as a publically accessible key server in Prerequisites > Miscellaneous. Changed date formats to include leading zeroes. Added 'About keybase.io' section. Formatted the signing policy to Markdown. Added the image available in both keys. Added 'I will keep this copy for reference' in 'Hardcopy of Fingerprint.' Added 'Thank You For Visiting!' at the end of the document.
  • Version 1.5, written and signed . Updated key with new Photographic UID. Added information about availability of a new primary key that utilizes ECC.
  • Version 1.4, written and signed . Changed Identity Verification to require an additional form of identification. Moved signature levels of photographic UID to Level 2.
  • Version 1.3, written and signed . Key fingerprint updated after updating the expiration date. Changed 'It may be replaced...' to 'This policy may be replaced...' to remove ambiguity. Added links to current document and signature to Version Information.
  • Version 1.2, written and signed . Key fingerprint updated after revocation of the 'creativityzoo.com' user ID and addition of the 'themindfulworkflow.com' user ID. Location information was updated. Minor word changes.
  • Version 1.1, written and signed . Minor grammar changes and section removal.
  • Version 1.0, written and signed . The original document.

Location

I currently reside in the western suburbs of Chicago, Illinois, United States. However, as a flight attendant, my profession takes me to various places around the continental United States. As such, the easiest way to meet with me to coordinate key verification would be to contact me via e-mail or Keybase to arrange a meeting.

Levels of Signatures

I utilize two certification levels:

  • Level 0 (0x10): I will issue this level of signature if I have met the key owner who wishes to obtain a signature to their key from me (hereafter called the "signee") in person and verified their identity according to the procedure below. Photographic UIDs will be signed at this level if I can still remember the signee's face during the act of signing. Only signing UIDs at this level helps mitigate the possibility of leaking detailed social connections.
  • Level 3 (0x13): This level of signature is reserved only for self signatures.

I do not utilize Level 1 (0x11) or Level 2 (0x12) certification levels.

Keys of Certification Authorities (CAs)

Keys of CAs are keys owned by a whole organization and not by an individual. Usually the fingerprints of those keys have to be verified by getting them from the corresponding website of the CA and cannot be checked by the Identity Verification procedures described below. If a viable procedure for verifying the 'identity' of a CA's keys is made known to me, I will add procedures for keys of CAs to the Identity Verification section. Until then, I will not sign keys owned by CAs.

Prerequisites for Signing

Identity Verification

The signee must prove their identity to me by way of a national ID card, a driver's license, or a similar identity document. The identity document must feature a photographic picture of the signee. This also implies that the signee's key must feature their real name.

In addition, the signee must provide a secondary form of identification that includes their name, with or without a picture. Acceptable examples include, but are not limited to, a business card, a conference badge, a credit card, or an additional identity document as defined in the last paragraph.

Hardcopy of Fingerprint

The signee should have prepared a printout of the output of gpg --fingerprint for their key (or the equivalent command of their OpenPGP client). I will keep this copy for reference.

A hand-written sheet featuring the key ID, the fingerprint, and all user IDs the signee wishes to obtain a signature to will also be accepted.

If the signee wishes to obtain a signature to a photographic user ID, the printout should contain the image of that photographic user ID. A printout or photocopy of a photo clearly showing the same person as in the photographic user ID will also be accepted.

Miscellaneous

  • The above must take place under reasonable circumstances, i.e. at a calm place, both parties not being in a hurry, etc.
  • The signee should make their public key available on a publicly accessible pgp.net keyserver, such as hkps.pool.sks-keyservers.net, through Web Key Directory, or through Keybase.
  • The signee should be willing to cross-sign with me.

The Act of Signing

Fingerprint Verification

At a secure location I will verify the key's fingerprint using the hardcopy of the fingerprint that has been given to me.

E-Mail Verification

After successful fingerprint verification, I will sign all user IDs which I was asked to sign. Each signature is then individually sent to the email address listed in the corresponding user ID, enciphered to the signee's key.

As only the signee can decipher and thus publish the signatures, it is warranted that the email addresses listed in each user ID with a published signature belongs to the signee.