What does a PGP signature on a Git commit prove?

Re:What does a PGP signature on a Git commit prove? by viraptor on Wednesday March 31, 2021 @08:35AM (#26646424)

> keys expire

Only if you want them to expire. They don't have to.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by rakoo on Wednesday March 31, 2021 @09:18AM (#26646882)

Given enough time, every secret becomes public. You really shouldn't expect your keys to be secure forever; because of that you definitely should have a form of key rotation in place.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by chii on Wednesday March 31, 2021 @08:50AM (#26646584)

A key can be involuntarily "expired" if the private key was leaked.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by viraptor on Wednesday March 31, 2021 @09:49AM (#26647254)

That's revocation.

[ Parent | on HN ]