[Monotone-devel] Re: key trust

[Lapo Luchini]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Richard Levitte - VMS Whacker wrote:
> I think you're operating under some false assumptions.  Just because a
> certificate was revoked yesterday, it doesn't mean that a signature
> made a week ago suddenly becomes invalid.

EXCEPT when the revocation reason is "key compromise", in that case you
can't even trust old signatures from that key. ;-)
(as they could be only "apparently" old, or the compromise could have
been discovered only much after the damage was done)

- --
L a p o   L u c h i n i
l a p o @ l a p o . i t
w w w . l a p o . i t /
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Cygwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iEYEARECAAYFAkNOneUACgkQaJiCLMjyUvs7dgCfTnh2RFzWdGZDcCTpmDfWIHlO
nXIAmgLzkloYkdKKRnC6zDzFsfSnxY/s
=HVK1
-----END PGP SIGNATURE-----