3 ms·
Does the last bullet in section 2.2 mean that clients hang on to revoked keys?
by sigjuice 8y ago
Does the last bullet in section 2.2 mean that clients hang on to revoked keys?
- epoch_100 8y agoYes. In fact, we even recommend that the fingerprints of revoked keys stay on the keylist for at least a few months to ensure that the key revocation is sent to all subscribers. If you were to remove the key from the keylist, it wouldn't be refreshed for the clients and therefore the clients may not know it is revoked. Holding on to revoked keys doesn't really present a security issue; because most clients won't even let you encrypt a message to a revoked key, it would be difficult for this to compromise security.