<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:228540667;
mso-list-type:hybrid;
mso-list-template-ids:722737394 260974760 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
@list l1
{mso-list-id:1145665805;
mso-list-type:hybrid;
mso-list-template-ids:897874542 1383370368 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:\F06E;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman";}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal>I prefer the OpenPGP cert model over the CA model because the CA model only allows one entity to sign your key, while OpenPGP offers more security by spreading your risk amongst several entities.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My understanding of key signing is that you only sign for what you believe to be true. The Certificate Authority Startcom created a certificate for my email address after Startcom verified my email address when I replied to their email check. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>AFAIK, to get a signed OpenPGP Certs I would need to attend a key signing party to verify my email address and check the key. I want OpenPGP to succeed, but why can’t I login into a site which sign’s the key of my email address after my email address has been verified. Why can’t the same happen for an IM address? Couldn’t a video call could verify my Photo? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I know that CA’s offer an Extended Validation service which require full identity checks, but the majority of online entities only want confirmation of their online identifier i.e. web address. OpenPGP key signing parties seem to me to match the Extended Validation service in requiring a full identity check.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My point is in most cases people would only want their online identifiers (email, IM/video call, blog) signed. That being the case why does the OpenPGP community require you to attend a key signing party?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>To me, the key signing criteria for OpenPGP Certs seems unnecessarily too high, preventing mainstream adoption of what I see as a better model. Please help me understand why the criteria is so high compared to CA Certs.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you for reading.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>--fiftyfour—<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p></div></body></html>