Keys using SHA-1 in the kernel keyring

Hello Konstantin,

sequoia (one of the alternative OpenPGP implementations) has a key
linter tool that analyses key material for "issues".

When applied to the keys stored in the kernel pgpkeys.git it reports:

	cat keys/* | sq cert lint --cert-file=-
	...
	Examined 643 certificates.
	  0 certificates are invalid and were not linted. (GOOD)
	  643 certificates were linted.
	  305 of the 643 certificates (47%) have at least one issue. (BAD)
	1 of the linted certificates was revoked.
	  0 of the 1 certificates has revocation certificates that are weaker than the certificate and should be recreated. (GOOD)
	51 of the linted certificates were expired.
	591 of the non-revoked linted certificates have at least one non-revoked User ID:
	  284 have at least one User ID protected by SHA-1. (BAD)
	  209 have all User IDs protected by SHA-1. (BAD)
	563 of the non-revoked linted certificates have at least one non-revoked, live
	subkey:
	  267 have at least one non-revoked, live subkey with a binding signature that uses SHA-1. (BAD)
	228 of the non-revoked linted certificates have at least one non-revoked, live,
	signing-capable subkey:
	  10 certificates have at least one non-revoked, live, signing-capable subkey with a strong binding signature, but a backsig that uses SHA-1. (BAD)

	  Error: 305 certificates have at least one issue

This is nearly half of the keyring that still relies on SHA-1. Among
them are the keys by Linus Torvalds, Greg Kroah-Hartman, and yourself.

Fixing is as easy as:

       sq key export --cert DE0E66E32F1FDD0902666B96E63EDCA9329DD07E |
                sq cert lint --fix --cert-file=- |
                sq cert import

Given that fixing is so easy and SHA-1 is broken since 20 years, at
least getting the high profile users who regularly sign archives (or
keyring commits :-) looks beneficial to me.

(You could even argue that the old archives should get resigned, but I'd
already be happy if future signatures will be fixed.)

If you agree this is an issue that should get fixed, I suggest the
following procedure:

 - Only accept new keys that the sequoia linter is happy with
 - Notify affected users by mail with an instruction how to fix their
   keys
 - Two months(?) later throw out all keys that still have issues.

Maybe drop the 51 expired public keys already now?

I'm happy to assist.

Best regards
Uwe

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmemPlAACgkQj4D7WH0S
/k6p/Qf/QwDREEY4n2cOP7CSmWmulvm1JE2Zj8wE45wsw86WvAFzVwFNbSRqvcbT
kWe5Nd6YlQInvDpEBjF5n3Y+vBN6CORhATgU1BwLV1YAtqGJ4qh2e8ZHB4SX21mB
nc3iIyVKd4VLXUAIJtLyiyhq8yi6Gv7sWXAdCfiA5B0glITlocyLv3qXK2AzzxZk
dxjKvnbJJRRIjoqBLnSCdn+BcuiGhxxMJK5Wh6uoJdkxNHU1UgorXkWjB1vJPVH4
AiJ6jhGpD1fGY5IvrC/SbyJ1IJSUI2fI/IB+nHg6YwygsOhDBDko//Y+FeUFEYfR
2sW64A32qnEp1FFSghtSsWPa7fWDDQ==
=uaGm
-----END PGP SIGNATURE-----