[tor-talk] Tor Browser Developers (signing key) key signing request (Was "Re: Problems? Verifying signatures in Tor 4.0.4")

[Richard Johnson]

On 2015-02-26 06:02, andre76 at fastmail.fm wrote:
> Is there anything that's wrong about the gpg verification performed on
> the version 4.0.4 as seen in the text below?
> It's quite different from previous Tor versions. No Erinn Clark.

We do have a chain from other Tor project personnel through Erinn Clark's key 
to a Tor Browser Developers (signing key) [1].  If you have physically 
verified their keys or Erinn's directly (or at least done a TOFU-like --lsign) 
in the past, you have a chain to the current Tor Browser Developers (signing key).

I think it would be great if the chain could be shortened.  Would more Tor 
project personnel be willing to confirm the Tor Browser Developers (signing 
key), and sign it directly?

Call it belt and suspenders with the web of trust alongside the published key 
info on the Tor site.


Richard

-------
[1]

$ gpg --list-sigs 0x93298290
pub   4096R/93298290 2014-12-15
uid                  Tor Browser Developers (signing key) 
<torbrowser at torproject.org>
sig          63FEE659 2015-01-13  Erinn Clark <erinn at torproject.org>
sig          4B7C3223 2014-12-15  Georg Koppen <gk at torproject.org>
sig 3        93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser at torproject.org>
sub   4096R/F65C2036 2014-12-15
sig          93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser at torproject.org>
sub   4096R/D40814E0 2014-12-15
sig          93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser at torproject.org>
sub   4096R/589839A3 2014-12-15
sig          93298290 2014-12-15  Tor Browser Developers (signing key) 
<torbrowser at torproject.org>


$ gpg --list-sigs 0x63fee659
pub   2048R/63FEE659 2003-10-16
uid                  Erinn Clark <erinn at torproject.org>
sig          31B0974B 2010-02-15  Andrew Lewman <andrew at lewman.is>
sig 3        94C09C7F 2010-08-25  Peter Palfrader
...
sig 3        63FEE659 2010-01-16  Erinn Clark <erinn at torproject.org>
sig          E012B42D 2010-07-19  Jacob Appelbaum <jacob at appelbaum.net>
sig          23291265 2010-07-19  Linus Nordberg <linus at nordberg.se>
sig          D21739E9 2010-03-22  Daniel Kahn Gillmor <dkg at fifthhorseman.net>
...
sig          A71A6915 2011-08-05  George Kadianakis <desnacked at riseup.net>
sig          28988BF5 2011-11-11  Roger Dingledine <arma at mit.edu>
sig          19F78451 2012-12-02  Roger Dingledine <arma at mit.edu>
sig          C11F6276 2013-03-19  David Fifield <david at bamsoftware.com>
...