To use your example, your brother posts a message on Twitter and you don't know your brothers Twitter username. If you're confident that it's your brother posti

To use your example, your brother posts a message on Twitter and you don't know your brothers Twitter username. If you're confident that it's your brother posting, then there's no problem. If you're uncertain that it's your brother, Keybase will let you verify it's him -- but that's a problem. Imagine a political dissident living in a dictatorship and it's the government who uses Keybase to match a Twitter username to a Facebook account. We don't want accounts tied together. People need multiple identities online. How do you get a persons key, and how do you know it's the right key? I think the answer will work like email addresses do now: someone will tell you a little info (name + hash@org) and you'll lookup their key.[0] Then you'll verify it as appropriate to the situation. That kind of system would allow and encourage multiple identities, and doesn't encourage posting PII. To "bring public key crypto to everyone" you don't need to build this kind of directory (where you verify accounts.) You can instead get companies to participate in a PKI that they control (like they control email, DNS, http, etc..) and then they'll integrate it into existing software, provide it to users, experiment with UX and client designs, etc... Making an open source, server-side solution lets you turn 'Sign in with Facebook' into an ally that not only gets Facebook to provide keys and integrate crypto, but invest in servers and software. Last, many people share a sentiment that a private key shouldn't leave our computers or phones (or fobs) to be managed by others. It's a reasonable attitude, but I think getting "crypto to everyone" and widely implemented is more important, and a managed system today doesn't preclude unmanaged keys in the future. [0] To expand on this example: I'm irq-1 ff38a9@keys.news.ycombinator.com, and at work I'm Alice 23ff45@work. If you lookup hash@org and find a string that looks right (a username or real name) then you get their public key. You have some confidence it's the right person, and are free to verify it further with any other means.