Re: Web of Trust work [Was: kernel.org tooling update]

On Fri, Jan 23, 2026 at 12:23:09PM -0500, James Bottomley wrote:
> > > Could you please stop doing this?  The Open Source norm is to
> > > release early and often and long before you have stable code so you
> > > get feedback incorporated *before* you're committed to something.
> > 
> > I'm not doing anything here, sorry.
> 
> You're listed as a presenter on the session Mauro pointed to.  And
> you're the only kernel developer on it, so I was presuming you were
> helping them out with kernel requirements.

They are primarily working with me, and just so it's clear -- this is not
any kind of assured thing. Here's where things stand:

- they asked us how we currently do our trust framework and I described the
  process and its drawbacks, which are real:

  - I am the bottleneck in the process, because all updates have to go through
    me; even if we add more people to have access, this would still be a
    bottleneck, because the more keys there are in the web of trust, the more
    finagling the whole process requires to deal with expirations, key
    updates, identity updates, etc. We can rely on modern keyservers for some
    of it, but not for third-party signatures, which are key for our
    distributed trust.
  - We can't reasonably expand this to all kernel developers (not just
    maintainers), because of constant churn of people coming, going, taking
    breaks, etc. Maintaining the web of trust consisting of thousands of keys,
    as opposed to hundreds, would become a full-time job if we stick to how
    it's currently done (via the git repo and manual verification on my part
    for all key additions).
  - We're limited to PGP only, but it would be nice to also support something
    like fido2 ssh key signatures.

- they said they could come up with something that would use self-sovereign
  did's that would allow scaling the trust framework to all kernel developers
  and be self-sustaining and verifiable via cross-signatures.

- I said: sure, come up with some code and let's see, as long as the following
  is assured:

  - It's opt-in; anyone who is happy using GnuPG can continue without any
    change
  - We're not forcing a complete rekeying or resigning of all keys
  - There is no central service that must be up and accessible for the tools
    to work
  - It's not written in some esoteric framework that requires curl | bash
    every 2 weeks to get the latest version

- I also made it very clear that the kernel community will have the final say
  in whether this is adopted or not.

This is pretty much where we stand.

-K