Re:Sign arbitrary data with your SSH keys
by csdvrx on Saturday November 13, 2021 @07:09PM
(#29214312)
I don't think you understand: the key is not mine, it's from the previous users of that domain, so I can't apply these instructions as I don't have their private keys!
To make things worse, there is no mechanism to let the key server know that the emails associated with these keys are invalid.
And I have tried my best to get in touch with maintainers to explain the stupidity of this situation, but there is apparently no way besides revocation certificates to deprecate or delete a key. Or, if I give a less generous interpretation, maybe they want to keep pretending that PGP still has a lot of users?
So a known bad key is associated with my domain, with no way to fix that - except maybe waiting for PGP key servers to die and be finally replaced by something better.
This is why I call that an outdated technology. I'm sure it was good 30 years ago, but it should have evolved.
To make things worse, there is no mechanism to let the key server know that the emails associated with these keys are invalid.
And I have tried my best to get in touch with maintainers to explain the stupidity of this situation, but there is apparently no way besides revocation certificates to deprecate or delete a key. Or, if I give a less generous interpretation, maybe they want to keep pretending that PGP still has a lot of users?
So a known bad key is associated with my domain, with no way to fix that - except maybe waiting for PGP key servers to die and be finally replaced by something better.
This is why I call that an outdated technology. I'm sure it was good 30 years ago, but it should have evolved.