3 ms·
> Unfortunately, PGP and GnuPG implement different semantics, neither documents their semantics, and OpenPGP does not specify how a web of trust implementation
by dane-pgp 5y ago
> Unfortunately, PGP and GnuPG implement different semantics, neither documents their semantics, and OpenPGP does not specify how a web of trust implementation should work.
Oof. So perhaps the lack of popularity of the WoT (for securing software supply chains, for example) is not solely due to the awkwardness of key-signing parties, or the user-unfriendliness of command-line tools.
> This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
It's a pity it doesn't also comply with RFC 2223 Section 9, which requires that all RFCs contain a "Security Considerations" section[0]. In fact, the document only uses the word (pattern) "secur*" once.
[0] https://datatracker.ietf.org/doc/html/rfc2223#section-9 https://datatracker.ietf.org/doc/html/rfc2223#section-9