Interestingly enough, since changing the GH keys is subject to GH authentication (possibly involving 2FA), the owner's key is kind of validated (by GH) so it _kind of_ makes GH a gpg key notary.
Having `git log --show-signatures` validate _all_ signatures is then a matter of:
Now I kind of wish GH would sign such user pub keys _at the time they're added_ (thus at the time GH authentication is deemed valid), thus ensuring they've not been tampered with in between.
With a bit of UI GH could present a UI for a user to validate another user's key, and sign that assertion (with a GH private key, not the user's of course) as well.
Of course it hinges on trusting GH, but GH already signs e.g UI borne merge commits on your behalf so there's that.
Then next step would be for GH to host an actual key server to accept off-band signed keys containing a magic comment that bind the keys and sigs to GH usernames...
Having `git log --show-signatures` validate _all_ signatures is then a matter of:
Now I kind of wish GH would sign such user pub keys _at the time they're added_ (thus at the time GH authentication is deemed valid), thus ensuring they've not been tampered with in between.With a bit of UI GH could present a UI for a user to validate another user's key, and sign that assertion (with a GH private key, not the user's of course) as well.
Of course it hinges on trusting GH, but GH already signs e.g UI borne merge commits on your behalf so there's that.
Then next step would be for GH to host an actual key server to accept off-band signed keys containing a magic comment that bind the keys and sigs to GH usernames...