throw0101c 5 days ago

> SPF/DKIM, as well as TLS etc., is just stupid shit we do because we're too lazy and/or incompetent to make web of trust work for us.

Having key signing parties for the entire world wide web does not seem scalable to me.

* https://en.wikipedia.org/wiki/Key_signing_party

1
globular-toast 5 days ago

If you want to have complete trust in every key you hold then you need to validate it personally. This is exactly the same scaling factor as Signal or WhatsApp, for example.

Web of trust scales better than that, though. It gives you confidence in keys you haven't seen yet because they are signed by other keys that you do trust. The key signing parties strengthen the web of trust, making it more likely a potential correspondent will receive a key signed by someone they trust and therefore potentially not needing to verify it personally.

It all depends how much confidence you want to have for each key. At the end of the day there is no substitute for verifying each key personally if you want to be completely sure. PGP give you the option to hold keys with a lower level of confidence for e.g. less sensitive communications.