3 ms·
A signature does not give you a public key. You actually need the pub key to verify the signature. I think one could still ask why you couldn't just use a mime
by upofadown 9y ago
A signature does not give you a public key. You actually need the pub key to verify the signature.
I think one could still ask why you couldn't just use a mime section for the public key in the same way that signatures are often attached.
- e12e 9y agoThe implied missing steps are a)publish key to keyserver network, and b) get fingerprint from signature and look up key on keyserver network. Bundling public key with every mail "feels" a bit heavy handed - given the key server infrastructure that already exist. (and special-casing "mail to new receiver" seems cumbersome. At least considering you'd probably want to sign all outgoing mail anyway[1]). [1] Ok, maybe not your bomb threats if they're designed to be anonymous - but that's getting into one of the other issues with pgp - non-repudiation.