Re: [Sks-devel] Implications of GDPR

[brent s.]

On 05/03/2018 07:40 AM, Moritz Wirth wrote:
> That does not help because you still Store european data which is still
> affected by the GDPR.
> 
> What about only accepting valid keys and removing all revoked or expired
> keys from the database? If someone wants to have his data deleted he can
> revoke his key and the revoked signature is synced over all keyservers
> which then delete them from their own db - new revoked keys are simply
> rejected. 
> 

how do you determine the "validity" of a key? do you mean in the
technical sense (not expired, revoked, etc.)? because others have
pointed out the issue with that.

or do you mean proving a user owns a key they push? if so, that has its
own problems- sure, you could send an email to the email address
associated with the key and require a reply (such as what
keyserver.pgp.com did - does? haven't used in a while), BUT...

not all keys have addresses associated (and this is the preferred method
for addressing the - admittedly, in my opinion, unfounded but still
commonplace - concern of spammers harvesting email addresses from keys).

-- 
brent saner
https://square-r00t.net/
GPG info: https://square-r00t.net/gpg-info

signature.asc
Description: OpenPGP digital signature