3 ms·

Isn't there an existing, working PKI for this? "I'm xy and have been signing commits using the key 0xdeadbeef for some time now, signing this message with the s

Isn't there an existing, working PKI for this? "I'm xy and have been signing commits using the key 0xdeadbeef for some time now, signing this message with the same key." (Yes, this still has holes, but it's a far smaller attack surface than "hello, it's me, trust me because I say so".)

Sebb767 6y ago
Looking at the commit history [0], it seems that the majority of the commits aren't signed. So no, this would probably not work for identifying everyone. [0] https://github.com/php/php-src/commits/master https://github.com/php/php-src/commits/master