[tor-bugs] #2617 [Website]: Add GPG keys to website, remove dependency to keyservers (was: no PGP keys)

[Tor Bug Tracker & Wiki]

#2617: Add GPG keys to website, remove dependency to keyservers
--------------------------+-------------------------------------------------
    Reporter:  confident  |       Owner:  phobos  
        Type:  task       |      Status:  reopened
    Priority:  critical   |   Milestone:          
   Component:  Website    |     Version:          
  Resolution:             |    Keywords:  key     
      Parent:             |      Points:          
Actualpoints:             |  
--------------------------+-------------------------------------------------
Changes (by proper):

  * status:  closed => reopened
 * cc: proper@… (added)
  * resolution:  user disappeared =>


Comment:

 I reopen this as a feature request, not as a bug report/support request.

 Keyserver was down yesterday again. It's also difficult to run GPG over
 Tor and httpS.
 Not sure how realistic is is, that the remaining keyservers get censored
 in China, Iran, etc.?

 All keys on the website would also allow to script download of Tor
 software (Tor Browser etc.) in a secure manner. (Get gpg key from tpo over
 https, download, verifiy gpg.)

 Proposed possible solutions:
 1) Add all GPG keys to https://www.torproject.org/docs/signing-
 keys.html.en copy and paste friendly. In case keyserver is offline or for
 other user cases.

 2) Make a new site with all GPG keys in plain text format and link it.

 3) Everyone person/project who is listed on
 https://www.torproject.org/docs/signing-keys.html.en gets it's own
 homepage. That's already partial done. The person/project adds it's GPG
 key to that site. It depends on whether they the are interested in such a
 homepage and keeping their key current.

 (Related ticket, no duplicate: #5606)

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2617#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online