Post #3914344

What keeps this from degrading into total chaos, is some notion of identity. If I start a project, I'm signing my commits with an SSH key and publishing them with an iroh key. These public key identities can be bound with an attestation; I sign my iroh key, which determines my network endpoint, with a well-known SSH key that is at least pinned to the content I'm producing. What's neat about these attestations in a public-key based networking system like #iroh, is peers can attest to each other. I could sign an attestation that I know another developer -- or sign a revocation if that developer becomes compromised, or leaves the project. Attestations linked to public key infrastructure we already use like published GPG and SSH keys, bootstraps some trust into the system. This is as much a social experiment as a technical exploration. I'm using git because it's a system I kind of know, but I'm also thinking about how other collaborative apps might work at the back of my mind. 2/