On Fri, 09 Dec 2016, David Goulet wrote:
One thing here that could block a user is the GPG key expiration. If the key is expired, I guess the validation should fail but would be nice that the user gets a meaningful message at that point.
In that case, this setup will need to have a quick way to retrieve a key that is in the database but not working (expired). Not sure how to pull that off but I'll let you think about it :).
If your key in db.torproject.org is expired, you screwed up. You file a ticket with tpa to have it updated. This isn't something that trac (or other consumers of the keyring) need to work around imo.
weasel