Re: ELPA security

[Stefan Monnier]

SM> I do wonder about key management, tho: the GNU ELPA key (note: not
SM> "maintainer" because the key does not belong to any human being)
SM> will not last for ever.
> I thought the maintainers would have their own keys, and they would sign
> a GNU ELPA "signing subkey" that's only used for releasing.

I'm sufficiently unsophisticated that I don't really know what
that means.  I understands keys can expire and can be revoked, but that
doesn't say how the end-user will deal with such a situation.

We need some way to update the signing key in a trustworthy way.


        Stefan