Re: dialback in DNA

> I'd need to double-check XEP-0220, one of our favorite documents. ;-)
>
>>>     an updated version of [XEP-0220], might define a DNA prooftype for
>>>     dialback
>>
>> I just tried that and failed.
>
> How so?

I could not figure out which proof of identity I wanted.

Did I want the proof that the receiving server is who it claims to be? 
With dialback, the proof seems to be "oh yeah, it is listening on the 
port DNS says"? That's pretty bad but we know it is vulnerable to DNS 
poisoning...

For the sending server, the proof is slightly better, db:verify and 
merlins spell assert the sender shares a secret with the authoritative 
server.

I just need to write up the formal prooftype definition for both.

It seems this is more complicated for dialback than for PKIX or 
POSH/DANE because it's not symmetric there. OTOH, we might have 
scenarios where we have PKIX in one direction and POSH in the other.