Post #2152922

Haha, that’s my cue, right? 😅 I’ll recap what I said elsewhere, the benefits of SSH over OpenPGP, as currently used: - no need for specialized destructuring with custom-made tools (https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/tree/master/keyring/packager?ref_type=heads), just a simple, human-readable file: https://github.com/openssh/openssh-portable/blob/master/.git_allowed_signers If someone changes a key or expiration you don’t need to parse base64 in your head :) - SSH signatures have a namespace field, thus making signature reuse harder but “there is no context separation for signatures in OpenPGP” (https://bugzilla.mozilla.org/show_bug.cgi?id=1953402#c3) - small technical details on how the signature is generated that makes it easier to integrate with HSMs (we’ve got quite an elaborate format for that in Signstar) - full-fledged verifier is truly a “weekend project”! https://github.com/wiktor-k/ssh-sig OpenPGP has a couple of advantages but this thing is already a bit too long to read ;)